> -----Original Message----- > From: rsyslog [mailto:[email protected]] On Behalf Of David > Lang > Sent: Thursday, January 26, 2017 7:10 PM > To: rsyslog-users > Subject: Re: [rsyslog] Question about $MaxMessageSize > > On Thu, 26 Jan 2017, Maupertuis Philippe wrote: > > > I would like to know how $MaxMessageSize works. > > Is the message just silently truncated ? > > Is there any trace or any counter about truncated messages ? > > Using TCP, not RELP, I speculate that the message is acknowledged to the > sender before being truncated by rsyslog. > > Is that correct ? > > If I set $ MaxMessageSize on a central server, is there any risk of > disturbance on the clients ? > > How can I find which default size is used on a particular rsyslog instance > (possibly included very old versions) ? > > with tcp, the data is acked by bytes at the OS layer, not by message at the > systlog layer, so when it is acked, it hasn't gotten to rsyslog yet, and the > OS > has no idea about the message structure. > > If a string of bytes longer than maxmessagesize arrives, rsyslog will take > maxmessagesize bytes and treat it as one message, and then start > processing the next bytes as another message (repeating as needed)
If the message length is 5000 bytes on the sender and 2000 bytes on the receiver, there will be three messages : The first 2000 bytes with valid syslog prefix A second message with 2000 bytes if whatever is in the sender messages thus without valid syslog prefix (and $FROMHOST) potentially leading to invalid dynafile relying on FROMHOST A third message with 1000 bytes like the second one. It seems to mean that the receiver must have $MaxMessageSize greater than any sender to process any message accurately. Is that correct > > There is no counter set when this happens. > > On very old versions the message size was 1k, but if you check the rsyslog > docs shipped with that version it will tell you. > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond > our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. !!!************************************************************************************* "Ce message et les pièces jointes sont confidentiels et réservés à l'usage exclusif de ses destinataires. Il peut également être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir immédiatement l'expéditeur et de le détruire. L'intégrité du message ne pouvant être assurée sur Internet, la responsabilité de Worldline ne pourra être recherchée quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'expéditeur ne donne aucune garantie à cet égard et sa responsabilité ne saurait être recherchée pour tout dommage résultant d'un virus transmis. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Worldline liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.!!!" _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
