Rsyslog on a RHEL 6 server is receiving messages locally on port 514 UDP. These messages are sometimes much larger than normal syslog message sizes. I am seeing rsyslog handle all of the messages just fine, it writes to the local files without issue. However, when I add a remote host to rsyslog config these same large messages are truncated at around 2048 characters.
I am running rsyslogd version: 5.8.10
rsyslogd 5.8.10, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No
The only changes I have made to rsyslog conf are these two things below:
This is at the very top of my rsyslog conf file:
This is at the very bottom of my rsyslog conf file:
$template RemoteHost,"<%%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg% *.* @my-rsyslog-central-logger:514; RemoteHost
Does anyone know why rsyslog would be truncating logs over UDP to the remote host, but is able to handle the logs when writing them to the local files?
**Note I did double check it wasn't happening at the remote rsyslog host, by using netcat to listen on a local port that rsyslog was forwarding to over UDP.
** Note I did try TCP and it did not truncate the large forwarded message, so now the question is why does UDP truncate. (I'm assuming the answer may be related to the properties of UDP, but I still want to know and maybe fix it if possible for UDP forwarded messages)