MonitorWare Knowledge Base

[Guest]

Hi,

We have logmessages exceed the syslog rfc 1024 chars... we experience that the activelogger component doesn't send the exceeding chars in an extra syslog message.

Cause we also use eventreporter tool, we know that in there, you can choose between different modes... Is that also possible for activelogger?

cheers,
Niels

[rgerhards]

Niels,

this sounds like a program bug. It should work. I have forwarded this to development. I'll keep you posted.

Best regards,
Rainer Gerhards
Adiscon

[rgerhards]

Just an update... We have reproduced and identified the issue. A fix is currently underway. We'll mail it as soon as it is ready later today. We'll also update the install set of ActiveLogger and post it on the web. I hope this, too, can be done today, but it may happen to be monday.

Rainer

[Guest]

Only the component file will do... We don't use the installer...

Btw, what is the expected behaviour for the component when the 1024 char limit is exceeded?

[rgerhards]

The component will send out the message with whatever size is given to it. It is then fully depending on the receiving syslog (as well as interim routers) to see what happens. Keep in mind that with UDP based delivery the message will most probably be split into multiple packets as soon ca. 1500 bytes in size are hit (the ethernet MTU). Depending on your syslogd, this can result in either

- two (or more) syslog entries
- no (due to format violation)
- one long entry

So if you go beyond the standard size, you need to do check very carfully what your syslogd does ... and keep in mind that it may change from version to version

Rainer