Getting Data In

output syslog blocked at 1000 characters

paulquinonero
New Member

Hi,

I want tu use syslog-ng to send windows logs from a heavy forwarder to an indexer. But I got a problem, the message is truncated to the first 1kb of data (due to the RFC). Do I have any solution to send my message through syslog without being truncated?

Thanks in advance.

0 Karma
1 Solution

mydog8it
Builder

I agree with @richgalloway , but according to the syslog-ng documentation the message size is limited to 64kb for SDATA and 256mb for IETF
https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-...

View solution in original post

0 Karma

mydog8it
Builder

I agree with @richgalloway , but according to the syslog-ng documentation the message size is limited to 64kb for SDATA and 256mb for IETF
https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.16/administration-...

View solution in original post

0 Karma

paulquinonero
New Member

The limitation is due to splunk configuration, not syslog-ng, but with the maxEventSize options I fix the problem, thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the HF is running on a Windows box then there is no need for syslog. Forwarders support Windows logs and can send them directly to indexers without an intermediate service.

---
If this reply helps you, an upvote would be appreciated.

paulquinonero
New Member

I know, but I need to use syslog due to constraints imposed by my compagny. But I finaly find what I need, the maxEventSize option.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!