MonitorWare Knowledge Base

Hi,

I'm using regex and templates to transfer syslog messages to MySQL and it seams that there is a limit with the length of the database output "engine":

As soon I reach the limit of 1024 characters with the template I receive errors from the rsyslogd when it start's up. Can you confirm this limitation and is there a work around?

Code: Select all

$template t_xxxxxxxxxxxxxxx_100, "insert into XXXXXXXXXXXXXXXXX (xxxxxxxxxxxxxx,xxxx,xxxxxxxxxxxxxxx,xxxxxxxxxxx,xxxxxxxxxxxxx,xxxxxxxxxxx,xxxxxxxxxxxxx,xxxxxxxxxxxxxx,xxxxxxxxxxxxxxxx,xxxxxxxxxxxx,xxxxxxxxxxxx,xxxxxxxxxxxxxx,xxxxxxxxxxxxxx,xxxxxxxxxxxx,xxxxxxxxx,xxxxxxxxxxxxxx,xxxxxxxxxxx) values ('xxx','%fromhost%','%syslogtag:R:[0-9]*--end%','%msg:R,ERE,1:xxxxxxxxxxxxx ([0-9]+)--end%','%msg:R,ERE,1:xxxxxxxxxxxxxx ([0-9a-zA-Z]+)--end%','%msg:R,ERE,1:xxxxxxxxxxxxx ([0-9:a-zA-Z .]+)--end%','%msg:R,ERE,1:xxxxxxxxxxxxxx ([0-9a-zA-Z]+)--end%','%msg:R,ERE,1:xxxxxxxxxxxxxxxx ([0-9a-zA-Z]+)--end%','%msg:R,ERE,1:xxxxxxxxxxxxxxxx ([0-9a-zA-Z]+)--end%','%msg:R,ERE,1:xxxxxxxxxxxxxxxxx ([0-9a-zA-Z() ]+)--end%','%msg:R:ERE,1:xxxxxxxxxxxxxxxx ([0-9:a-zA-Z .]+)--end%','%msg:R,ERE,1:xxxxxxxxxxxxxxx ([0-9:a-zA-Z .]+)--end%','%msg:R,ERE,1:xxxxxxxxxxxxxxxx ([0-9]+)--end%','%msg:R,ERE,1:xxxxxxxxxxxxxxx ([0-9]+)--end%','%msg:R,ERE,1:xxxxxxxxx ([0-9]+)--end%','%msg:R,ERE,1:xxxxxxxxxxxxxxx ([0-9]+)--end%','%msg:R,ERE,1:xxxxxxxxxxxxxxxxxxxxxx ([0-9]+)--end%');", SQL


Regards
Thomas

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

That's a config file line length limit. You need to compile with special settings. Let me check what you need to do.

OK, the limit is actually defined by the standard C BUFSIZ define. This is probably not too smart... For the time being, you can change it if you go to runtime/config.c, search for "BUFSIZ" (2 occurences) and replace it with any value of your liking. I'll probably change this at least to a different setting, make it larger by default and probably remove the limit at all. But that's for the master branch. Beta will probably receive "just" a larger limit.

HTH
Rainer

FYI: I am right now in the process of releasing the 3.19.12 beta, which includes a larger permitted input size. The patch may be useful for you:

http://git.adiscon.com/?p=rsyslog.git;a ... bef1eb4ddf

Rainer