Truncated message when using TCP Logging to Splunk

[#1]

I have a message logging policy looking like this:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<MessageLogging async="false" continueOnError="false" enabled="true" name="tcp-logger">
    <DisplayName>tcp logger</DisplayName>
    <Syslog>
        <FormatMessage>false</FormatMessage>
        <Message>{logMessage}</Message>
        <Host>hostname</Host>
        <Port>portnumber</Port>
        <Protocol>TCP</Protocol>
    </Syslog>
    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
</MessageLogging>

The problem I have is that when my logMessage is longer than ~ 4000 characters, it gets truncated. Where would such truncation be taking place?

As an experiment, I wrote a small java app to send the same message into splunk - that isn't getting truncated. So I'm sure the truncation is happening APIgee side.

[DChiesa]

That's puzzling. For TCP syslog there is no limit on the max size of the packet or payload. The design intent is that you can send as long a stream as you want to.

Are you certain there are no newlines in the {logMessage} context variable?

Is it feasible for you to do some further tests and pin down exactly where the cut-off is in terms of size of the message? Could you write a script + test API proxy that successively logs larger and larger messages to explore the limit?

Do you have Apigee Edge SaaS or a customer-managed Apigee Edge? If you are managing Apigee Edge yourself, you can check the MP logs for anything that looks odd regarding syslog. If you have Apigee Edge SaaS then you can contact Apigee Edge support and ask THEM to check your logs for you, to help diagnose and troubleshoot this.

I don't know what else to suggest, sorry!

[Prashant819]

Hello @Dino-at-Google,

I am facing similar issue and there are line breaks present in the log message.

Is it the expected behavior when there are new lines present in the the log message and log message is sent over syslog TCP/SSL ?

I have asked a separate question on this topic. Please have a look here.

Thanks.