[rsyslog-notify] Forum Thread: Re: Rsyslog silently discarding messages - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26838#p26838

Message: 
----------
with syslog over TCP, the delimiter between messages is a newline, if there
are no newlines, rsyslog is required to believe that there is more data due
to arrive as part of this message.
 
When the message size exceeds th youe maxmessagesize, rsyslog will process
maxmessagesize bytes as one message and the remainer of what's arrived will
become the beginning of the next message.

If you can't fix the switch to send messages with a newline, switch back to
using UDP. With UDP the message is required to be in a single packet (which
can be fragmented for delivery across a network with a MTU lower than the
packet size) a newline isn't required.