On Thu, 26 Jan 2017, Maupertuis Philippe wrote:
I would like to know how $MaxMessageSize works.
Is the message just silently truncated ?
Is there any trace or any counter about truncated messages ?
Using TCP, not RELP, I speculate that the message is acknowledged to the
sender before being truncated by rsyslog.
Is that correct ?
If I set $ MaxMessageSize on a central server, is there any risk of
disturbance on the clients ?
How can I find which default size is used on a particular rsyslog instance
(possibly included very old versions) ?
with tcp, the data is acked by bytes at the OS layer, not by message at the
systlog layer, so when it is acked, it hasn't gotten to rsyslog yet, and the OS
has no idea about the message structure.
If a string of bytes longer than maxmessagesize arrives, rsyslog will take
maxmessagesize bytes and treat it as one message, and then start processing the
next bytes as another message (repeating as needed)
There is no counter set when this happens.
On very old versions the message size was 1k, but if you check the rsyslog docs
shipped with that version it will tell you.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
