[rsyslog] limiting message size while forwarding messages

[david at lang.hm]

On Thu, 8 Oct 2009, Sayan Chowdhury wrote:

> I agree ...  As long as rsyslog has a mechanism to do the truncation if
> somebody wants on the egress(which it has), it is fine. I don't think the
> default template should change.
> BTW, there are implementations out there which behaves badly when they
> receive large messages/control characters etc. I want to be defensive about
> what  send out and hence my requirement.

which implementation caused you grief? (so I know what to avoid)

David Lang

>
>
>
> On Thu, Oct 8, 2009 at 3:41 AM, <david at lang.hm> wrote:
>
>> On Thu, 8 Oct 2009, Rainer Gerhards wrote:
>>
>>>> -----Original Message-----
>>>> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
>>>> bounces at lists.adiscon.com] On Behalf Of Sayan Chowdhury
>>>>
>>>> Yes, I saw that too ... I made the template based out of Rsyslog
>>>> traditional
>>>> forward format and then used the property replacer as you mentioned.
>>>> It works like a charm. Thanks a bunch!
>>>
>>> I am glad it works, but I also tend to think that the default template is
>>> probably not correct. As it claims to be "traditional" format, I think it
>>> should really limit itself to 1K message size, so that another template
>> must
>>> be picked if messages of "non-traditional large size" are to be
>> transmitted.
>>>
>>> However, changing that default would potentially break a number of
>> existing
>>> deployments.
>>>
>>> Does anybody else have an opinion on that?
>>
>> existing syslog implementations already need to be able to deal with
>> oversized messages (almost nothing checks the size before it gets sent),
>> so I don't see a big benifit in changing rsyslog to limit what it outputs.
>>
>> David Lang
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com
>>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
>