[rsyslog-notify] Forum Thread: Re: Uncompression of a message failed, cannot enable debug - (Mode 'reply')

[noreply at adiscon.com]

User: mtovey 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24852#p24852

Message: 
----------
I never could get any debug output from the system other than the process
start-up messages.  But I think I solved the error message issue anyway.  I
looked through the source code and found the message in parser.c.  The
comments in that section of code talked about this message being generated
if a compressed message was truncated due to it exceeding the maximum
message size, thus rendering the message to be garbage and not
uncompromisable.  I tried increasing MaxMessageSize (it was already at
4096), but it didn't seem to matter what I set that to; I still got the
message.
I scanned the Internet about MaxMessageSize, and I finally found someone
else's posting about having trouble with MaxMessageSize until he moved it
to before the network module definition lines (imudp, imtcp) in the
configuration.  I tried that too, and sure enough, the issue appears to
have been resolved.
So, I think that the documentation needs to stress that the order of the
configuration parameters is important.  I have run into that a couple of
times previous to this, so I was not surprised when just moving a parameter
changed the behavior of the process.  The real problem is in knowing what
order parameters should be in.  After thinking about it, it makes sense
that the message size needs to be known prior to setting up the network
listeners so that the buffers can be allocated properly, but something like
that isn't going to be intuitive to everyone.
-Mark