[rsyslog-notify] Forum Thread: Messages received via IMTCP split at 8103 bytes - (Mode 'post')

[noreply at adiscon.com]

User: solarboyz1 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24907#p24907

Message: 
----------
We have an F5 ASM logging via tcp to rsyslog v7.6.3 running on a RHEL 6.5
server.  

Occasionally we find long messages get split. In all cases the split occurs
at exactly 8103 bytes, including the  timestamp, hostname, and tag fields
inserted by rsyslog. 

Looking at a tcpudmp:
  I can't find any correlation between where it is split when being written
and how the message is split across TCP packets. 
  The message is not being split due to a newline (#0a) in the message. 

Is there an ~8k maximum message size that is implemented in v7 that is
causing this, and if so can it be changed? What else would cause this type
of behavior? 


Here is the rsyslog configuration in place:

[code:sd6h4lnp]###-- Load Modules      --###

Module(load="imudp")
Module(load="imtcp")
Module (load="imuxsock")
Module (load="imklog")

###-- Global Options --###
$umask 0000
$CreateDirs on
$FileCreateMode 0644
$RepeatedMsgReduction off
$EscapeControlCharactersOnReceive off
$OMFileASyncWriting off
$WorkDirectory /var/rsyslog

###-- Device Specific Rules --##

template (name="d_asm" type="string"
string="/mnt/syslog/asm/%$myhostname%.%$DAY%%$MONTH%%$HOUR%.log")
ruleset (name="r_asm") {
        action(type="omfile" DynaFile="d_asm" DirCreateMode="0755")
}
input(type="imtcp" port="xxxxxx" ruleset="r_asm")[/code:sd6h4lnp]

OS: RHEL 6.5

RSYSLOG:
[code:sd6h4lnp]rsyslogd 7.6.3, compiled with:
        FEATURE_REGEXP:                         Yes
        FEATURE_LARGEFILE:                      No
        GSSAPI Kerberos 5 support:              Yes
        FEATURE_DEBUG (debug build, slow code): No
        32bit Atomic operations supported:      Yes
        64bit Atomic operations supported:      Yes
        Runtime Instrumentation (slow code):    No
        uuid support:                           Yes
        Number of Bits in RainerScript integers: 32 (due to too-old
json-c lib)[/code:sd6h4lnp]
  

Thanks,