Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages just fine, it writes to the local files without issue. However, when I add a remote host to rsyslog config these same large messages are truncated at around 2048 characters.

I am running rsyslogd version: 5.8.10

rsyslogd 5.8.10, compiled with:
  FEATURE_REGEXP:               Yes
  FEATURE_LARGEFILE:            No
  GSSAPI Kerberos 5 support:        Yes
  FEATURE_DEBUG (debug build, slow code):   No
  32bit Atomic operations supported:    Yes
  64bit Atomic operations supported:    Yes
  Runtime Instrumentation (slow code):  No

The only changes I have made to rsyslog conf are these two things below:

This is at the very top of my rsyslog conf file:

 $MaxMessageSize 64k

This is at the very bottom of my rsyslog conf file:

$template RemoteHost,"<%%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%
*.* @my-rsyslog-central-logger:514; RemoteHost

Does anyone know why rsyslog would be truncating logs over UDP to the remote host, but is able to handle the logs when writing them to the local files?

**Note I did double check it wasn't happening at the remote rsyslog host, by using netcat to listen on a local port that rsyslog was forwarding to over UDP.

** Note I did try TCP and it did not truncate the large forwarded message, so now the question is why does UDP truncate. (I'm assuming the answer may be related to the properties of UDP, but I still want to know and maybe fix it if possible for UDP forwarded messages)

share|improve this question

1 Answer 1

up vote 1 down vote accepted

UDP doesn't have sequence numbers, there would be no way to combine messages coherently (if they arrive out of order)

Syslog UDP Transport - http://tools.ietf.org/html/rfc5426

3.1. One Message Per Datagram

Each syslog UDP datagram MUST contain only one syslog message, which MAY be complete or truncated. The message MUST be formatted and truncated according to RFC 5424 [2]. Additional data MUST NOT be present in the datagram payload.

share|improve this answer
    
Thanks, this is what I figured it was, but wanted to see if there was a way to not fragment the packets. I think the better answer is the section here: tools.ietf.org/html/rfc5426#section-3.2 - this talks about actual size of the packet that will successfully be sent based on recommendations from the RFC. So in other words stop using UDP for syslog messages sent over the wire. (However, I believe there is still a case to use UDP locally on a server) –  nictrix Feb 20 at 7:14
    
If its the local server, just use sockets (/dev/log) –  Jeff Warnica Feb 20 at 14:12
    
Ahh yes good idea –  nictrix Feb 20 at 18:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.