Very long log events coming over syslog 514/udp are cut

[Zoe_]

Hello
Has anyone encountered the situation of incomplete log transmission using UDP 514? Would changing to TCP be useful？

I would appreciate your support.
greetings

[livehybrid]

Hi @Zoe_ ,

Yes, switching from UDP to TCP might resolve incomplete log events sent via syslog.

UDP is a connectionless protocol and does not guarantee delivery or prevent truncation, especially for logs larger than the network's MTU size (typically around 1500 bytes). TCP establishes a connection, ensures ordered and reliable delivery, and handles segmentation and reassembly of large messages, preventing truncation.

# Update your inputs.conf to receive TCP instead of UDP.

[tcp://514]
connection_host = ip # Or dns, depending on your needs
sourcetype = syslog # Set appropriate sourcetype
# Add other settings like index as needed
disabled = 0

# Ensure your old UDP input is disabled
#[udp://514]
#disabled = 1

Remember to restart Splunk or reload the configuration after changes.

Ensure any firewalls between the sending devices and the Splunk receiver allow traffic on the chosen TCP port (e.g., 514).

🌟 Did this answer help you? If so, please consider:

• Adding kudos to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PickleRick]

With UDP you are limited to a single datagram's length. I think I saw one or two solutions which would split the event at frame boundary and send the remaining part in another frame but there's no reliable way to reassemble those later.

Yes, switching to TCP should solve this issue but might cause performance problems in some cases.