topic Re: Syslog data from UDP. Maximum message size? in Getting Data In

Syslog data from UDP. Maximum message size?

eject — Fri, 15 Jul 2011 10:11:56 GMT

What's maximum message size which splunk's syslog will accept via UDP? How I can increase it?

Re: Syslog data from UDP. Maximum message size?

hazekamp — Fri, 15 Jul 2011 18:54:38 GMT

Splunk uses the TRUNCATE setting in props.conf to determine maximum message size. By default this is set to 10000 bytes.

## props.conf.spec
TRUNCATE = <non-negative integer>
* Change the default maximum line length (in bytes).
* Although this is in bytes, line length is rounded down when this would
  otherwise land mid-character for multi-byte characters.
* Set to 0 if you never want truncation (very long lines are, however, often a sign of
  garbage data).
* Defaults to 10000 bytes.

Re: Syslog data from UDP. Maximum message size?

eject — Mon, 18 Jul 2011 10:54:50 GMT

I've set TRUNCATE = 0 in C:\Program Files\Splunk\etc\system\default\props.conf and restarted Splunk. tried to send 2600 bytes and it don't displayed :(.

With wireshark I see that that messages reached server.

All messages which are smaller than 1900 bytes displays just fine. How can I debug this problem ?

Re: Syslog data from UDP. Maximum message size?

BenAveling — Fri, 18 Oct 2013 00:42:23 GMT

This sounds like a UDP problem, not a splunk problem.

For me, anything up to 65507 bytes is received (and truncated to 10000 bytes). Anything longer just gets lost.

If you have perl, maybe try sending to the following script and seeing what happens:

my $usage = qq{Usage:
  perl udp_server.pl port
};

use strict;

use IO::Socket;

my $port=shift or die "port not specified\n\n$usage";

my $response = IO::Socket::INET->new(Proto=>"udp",LocalPort=>$port)
  or die "Can't make UDP server: $@";

my $message=0;

while(1){
  print "Listening on $port...\n";
  my ($datagram,$flags);
  $response->recv($datagram,100000,$flags) or warn "recv failed: $!\n";
  print "Got message ",++$message," from ", $response->peerhost,", flags ",$flags || "none",": $datagram\n", "length: ",length $datagram,"\n";
}

Re: Syslog data from UDP. Maximum message size?

dwaddle — Fri, 18 Oct 2013 02:42:30 GMT

I might suggest trying to run strace on splunk's calls to recv(). You'll want to make sure that the buffer size passed to recv() is big enough to receive the whole datagram in one call.