MonitorWare Knowledge Base

[jcoder]

hi,
I have been forwarding events from a log file in a windows based server to a syslog server,the additional data associated with the error event goes thru only partially i.e only a few lines go thru and the rest are lost.Is there a special configuration to get all the lines in the file thru to the syslog server?

I thought this was characteristic in case of UDP, but in this case this is happening over the TCP

Hope u could provide me with an insight.

Regards
Jcoder

[alorbach]

Hi,

it also depends on what kind of sender you are using.
Syslog for itself is not build for larger messages, and not every receiver will be able to receive long Syslog messages.

If you could give us some more details about the syslog recipient, this would be helpfull.

best regards,
Andre Lorbach

[jcoder]

hi,
I m sending the data from the logs to a splunk server, the lines following an error event (describing location of the error etc) do not make it completly

[alorbach]

Then I guess that the Splunk Server treats line feeds as end of message, or can not handle larger Syslog messages.