MonitorWare Knowledge Base

[petersabaini]

It seems rsyslog gets confused by log messages larger than 2kb. My setup: local rsyslogds log via GnuTLS to a proxy and onwards to a central server, where entries are written to per-host logfiles. All rsyslogds are configured with "$MaxMessageSize 64k"

If I insert a test message, eg. "logger 000aaa...(x2050)bbbb" the first ~2000 chars get logged to the resp. host log, but for the rest of the message a bogus new file aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbb.log is created.

Often, the receiving rsyslogd seems to hang afterwards, but this is not consistent. When running rsyslogd -d, I get something like this:

Code: Select all

0934.043357448:imuxsock.c: Message from UNIX socket: #3
0934.043459140:imuxsock.c: logmsg: flags 4, from 'itangast', msg Mar 11 12:35:34 root: 00000aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa^@ ^@^@^@0^@^@^@<A0>^K<80>A^@^@^@^@<E0>
<80>A^@^@^@^@@^@^@^@^@^@^@^@%^@^@^@^@^@^@^@^D^@^@^@^@^@^@^@<F0>^Q<81><AB><AA>*^@^@<C4>^S<81><AB><AA>*^@^@<FF><FE><FE><FE><FE><FE><FE><FE>^H^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@<F6>^P<80><AB>^@^@^@^@<88>^S
<82><AB><AA>*^@^@ ^@<80><AB><AA>*^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@<F6>^P<80><AB><AA>*^@^@^@^@^A^@^@^@^@^@<B0>^T<82><AB><AA>*^@^@<D2><FC><ED><9F>m+^@^@
^@^@^@^@^@^@^@YH,<A0>m+^@^@^@^@^@^@^@^@^RM<EE><9F>m+^@^@@^R<82><AB><AA>*^@^@@^R<82><AB><AA>*^@^@<C4>^S<81><AB><AA>*^@^@^?<B5>@^@^@^@^@^@@^R<82><AB><AA>*^@^@^D^@<82><AB>^@^@^@^@<F6>^P<80><AB><AA>*^@
^@<A8><E4>@^@^@^@^@^@^@^@^@^@^D^@^@^@YH,<A0>m+^@^@0<9B>T^@^@^@^@^@^A^@^A^@^@^@^@^@^@^@^@^@^@^@^@^@@^R<82><AB><AA>*^@^@^A^@^@^@^@^@^@^@^D^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^A^@^@^@^@^@^@
^@^@^@^A^@^@^@^@^@^@U<<A0>m+^@^@<D2>?,<A0>m+^@^@PH,<A0>m+^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@<80>^L<80>A^@^@^@^@<90> <80>A^@^@^@^@<90>^\<80>A^@^@^@^@^@^@^@^@^@^@<D0>^H<80><AB><AA>*
^@^@@V<<A0>m+^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@Message has legacy syslog format.
0934.043531777:imuxsock.c: main queue: entry added, size now 1 entries
0934.043551333:imuxsock.c: wtpAdviseMaxWorkers signals busy
0934.043572565:imuxsock.c: main queue: EnqueueMsg advised worker start
0934.043601900:imuxsock.c: --------imuxsock calling select, active file descriptors (max 3): 3
0934.043630954:main queue:Reg/w0: main queue: entry deleted, state 0, size now 0 entries
0934.043658892:main queue:Reg/w0: Called action, logging to builtin-fwd
0934.043675654:main queue:Reg/w0: action 1 queue: entry added, size now 1 entries
0934.043693813:main queue:Reg/w0: wtpAdviseMaxWorkers signals busy
0934.043711693:main queue:Reg/w0: action 1 queue: EnqueueMsg advised worker start
0934.043732925:main queue:Reg/w0: main queue:Reg/w0: worker IDLE, waiting for work.
0934.044718553:action 1 queue:Reg/w0: action 1 queue: entry deleted, state 0, size now 0 entries


I'm running 4.4.1 on the sender and proxy and 4.6.0 on the server.

[rgerhards]

All rsyslogds are configured with "$MaxMessageSize 64k"

This *must* be configured before loading the modules in question. Otherwise it will not affect the modules loaded before the directive. So it is best to do it right at the top of rsyslog.conf.

And, yes: it's ugly, but that's the way it currently is (no time to change the config format...)

[rgerhards]

Oh, and a note on the debug output. There was a 2k buffer inside the debug system itself, and that one overflows. I just happen to have fixed that yesterday. But that's a debug-mode only issue.

[petersabaini]

Ah, works better now -- thank you!