topic Re: output syslog blocked at 1000 characters in Getting Data In

output syslog blocked at 1000 characters

paulquinonero — Tue, 10 Mar 2020 16:15:02 GMT

Hi,

I want tu use syslog-ng to send windows logs from a heavy forwarder to an indexer. But I got a problem, the message is truncated to the first 1kb of data (due to the RFC). Do I have any solution to send my message through syslog without being truncated?

Thanks in advance.

Re: output syslog blocked at 1000 characters

richgalloway — Tue, 10 Mar 2020 16:40:08 GMT

If the HF is running on a Windows box then there is no need for syslog. Forwarders support Windows logs and can send them directly to indexers without an intermediate service.

Re: output syslog blocked at 1000 characters

mydog8it — Tue, 10 Mar 2020 17:32:22 GMT

I agree with @richgalloway , but according to the syslog-ng documentation the message size is limited to 64kb for SDATA and 256mb for IETF
https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-guide/option-description-log-msg-size

Re: output syslog blocked at 1000 characters

paulquinonero — Wed, 11 Mar 2020 08:10:36 GMT

I know, but I need to use syslog due to constraints imposed by my compagny. But I finaly find what I need, the maxEventSize option.

Re: output syslog blocked at 1000 characters

paulquinonero — Wed, 11 Mar 2020 08:11:33 GMT

The limitation is due to splunk configuration, not syslog-ng, but with the maxEventSize options I fix the problem, thanks!