Long log messages (>5KB) logged into a syslog server gets splits into multiple lines

[aneeshananthakr]

Hi,

I see that long log message (>5KB) is getting split into multiple lines (each of around 2KB in size) when it makes it into syslog file. What could be the reason? (I am using Apigee Edge Cloud)

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<MessageLogging async="false" continueOnError="false" enabled="true" name="ML_Syslog">
    <DisplayName>ML_Syslog</DisplayName>
    <Syslog>
        <Message>{syslog_message}</Message>
        <Host>abc.com</Host>
        <Port>514</Port>
        <Protocol>TCP</Protocol>
        <FormatMessage>true</FormatMessage>
    </Syslog>
</MessageLogging>

Thanks,
Aneesh.

[kevinford]

Hi Aneesh,

The syslog spec states that the receiver should be able to accept up to ~2k and that it may receive more but can discard/truncate beyond that.

6.1.  Message Length

   Syslog message size limits are dictated by the syslog transport
   mapping in use.  There is no upper limit per se.  Each transport
   mapping defines the minimum maximum required message length support,
   and the minimum maximum MUST be at least 480 octets in length.

   Any transport receiver MUST be able to accept messages of up to and
   including 480 octets in length.  All transport receiver
   implementations SHOULD be able to accept messages of up to and
   including 2048 octets in length.  Transport receivers MAY receive
   messages larger than 2048 octets in length.  If a transport receiver
   receives a message with a length larger than it supports, the
   transport receiver SHOULD truncate the payload.  Alternatively, it
   MAY discard the message.

   If a transport receiver truncates messages, the truncation MUST occur
   at the end of the message.  After truncation, the message MAY contain
   invalid UTF-8 encoding or invalid STRUCTURED-DATA.  The transport
   receiver MAY discard the message or MAY try to process as much as 

possible in this case.