Mailing List Archive: oversizemsg

oversizemsg

Sep 18, 2023, 5:04 AM

Post #1 of 4 (137 views)

Question for maintainers regarding rsyslog 8.2210. I am using the following in the configuration…

maxMessageSize="32k"
oversizemsg.errorfile="/path/to/oversize.out"
oversizemsg.input.mode="truncate"

…and I am getting LOTS of the following in the rsyslog log file…

rsyslog: imptcp ptcp-51408-in: message received is at least X byte larger that was msg size; message will be split at: "random 32 chars from message str"

…but there is never anything written to /path/to/oversize.out

Is this expected behavior?

Thanks and regards,
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: oversizemsg [ In reply to ]

rsyslog at lists

Sep 18, 2023, 12:15 PM

Post #2 of 4 (136 views)

Permalink

please post your full config including any included files

rsyslogd -N1 -o /path/to/file

will create the combined config as rsyslog sees it, and report any config errors
it finds along the way.

David Lang

On Mon, 18 Sep 2023, John Chivian via rsyslog wrote:

> Question for maintainers regarding rsyslog 8.2210. I am using the following in the configuration…
>
> maxMessageSize="32k"
> oversizemsg.errorfile="/path/to/oversize.out"
> oversizemsg.input.mode="truncate"
>
> …and I am getting LOTS of the following in the rsyslog log file…
>
> rsyslog: imptcp ptcp-51408-in: message received is at least X byte larger that was msg size; message will be split at: "random 32 chars from message str"
>
> …but there is never anything written to /path/to/oversize.out
>
>
> Is this expected behavior?
>
>
> Thanks and regards,
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: oversizemsg [ In reply to ]

rsyslog at lists

Sep 19, 2023, 3:26 AM

Post #3 of 4 (136 views)

Permalink

I reviewed the code - it's puzzling. It looks like the config system
for that param got implemented, but that part of the config is never
used. Looks a bit like PR is missing. I need to investigate closer.
I'd appreciate the creation of a github issue.

Rainer

El lun, 18 sept 2023 a las 21:15, David Lang via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> please post your full config including any included files
>
> rsyslogd -N1 -o /path/to/file
>
> will create the combined config as rsyslog sees it, and report any config errors
> it finds along the way.
>
> David Lang
>
> On Mon, 18 Sep 2023, John Chivian via rsyslog wrote:
>
> > Question for maintainers regarding rsyslog 8.2210. I am using the following in the configuration…
> >
> > maxMessageSize="32k"
> > oversizemsg.errorfile="/path/to/oversize.out"
> > oversizemsg.input.mode="truncate"
> >
> > …and I am getting LOTS of the following in the rsyslog log file…
> >
> > rsyslog: imptcp ptcp-51408-in: message received is at least X byte larger that was msg size; message will be split at: "random 32 chars from message str"
> >
> > …but there is never anything written to /path/to/oversize.out
> >
> >
> > Is this expected behavior?
> >
> >
> > Thanks and regards,
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: oversizemsg [ In reply to ]

rsyslog at lists

Sep 19, 2023, 5:36 AM

Post #4 of 4 (136 views)

Permalink

Thank you Rainer, the ticket is created as requested (#5228). Please reach out if you have questions but it looks fairly straightforward.

Regards,

> On Sep 19, 2023, at 05:26, Rainer Gerhards via rsyslog <rsyslog@lists.adiscon.com> wrote:
>
> I reviewed the code - it's puzzling. It looks like the config system
> for that param got implemented, but that part of the config is never
> used. Looks a bit like PR is missing. I need to investigate closer.
> I'd appreciate the creation of a github issue.
>
> Rainer
>
> El lun, 18 sept 2023 a las 21:15, David Lang via rsyslog
> (<rsyslog@lists.adiscon.com>) escribió:
>>
>> please post your full config including any included files
>>
>> rsyslogd -N1 -o /path/to/file
>>
>> will create the combined config as rsyslog sees it, and report any config errors
>> it finds along the way.
>>
>> David Lang
>>
>> On Mon, 18 Sep 2023, John Chivian via rsyslog wrote:
>>
>>> Question for maintainers regarding rsyslog 8.2210. I am using the following in the configuration…
>>>
>>> maxMessageSize="32k"
>>> oversizemsg.errorfile="/path/to/oversize.out"
>>> oversizemsg.input.mode="truncate"
>>>
>>> …and I am getting LOTS of the following in the rsyslog log file…
>>>
>>> rsyslog: imptcp ptcp-51408-in: message received is at least X byte larger that was msg size; message will be split at: "random 32 chars from message str"
>>>
>>> …but there is never anything written to /path/to/oversize.out
>>>
>>>
>>> Is this expected behavior?
>>>
>>>
>>> Thanks and regards,
>>> _______________________________________________
>>> rsyslog mailing list
>>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.