Getting Data In

output syslog blocked at 1000 characters

paulquinonero
New Member

Hi,

I want tu use syslog-ng to send windows logs from a heavy forwarder to an indexer. But I got a problem, the message is truncated to the first 1kb of data (due to the RFC). Do I have any solution to send my message through syslog without being truncated?

Thanks in advance.

0 Karma
1 Solution

mydog8it
Builder

I agree with @richgalloway , but according to the syslog-ng documentation the message size is limited to 64kb for SDATA and 256mb for IETF
https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-...

View solution in original post

0 Karma

mydog8it
Builder

I agree with @richgalloway , but according to the syslog-ng documentation the message size is limited to 64kb for SDATA and 256mb for IETF
https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-...

0 Karma

paulquinonero
New Member

The limitation is due to splunk configuration, not syslog-ng, but with the maxEventSize options I fix the problem, thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the HF is running on a Windows box then there is no need for syslog. Forwarders support Windows logs and can send them directly to indexers without an intermediate service.

---
If this reply helps you, Karma would be appreciated.

paulquinonero
New Member

I know, but I need to use syslog due to constraints imposed by my compagny. But I finaly find what I need, the maxEventSize option.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...