hvisage / metalog

metalog is a syslog replacement that allows regular expresion matching

GNU General Public License v2.0

35 stars 10 forks source link

msg size #10

Closed tczaude closed 5 months ago

tczaude commented 4 years ago

Hi i have problem My web app send very big msg. metalog truncate this to some around 2000 signs. How i can increase this limit ?

tczaude commented 4 years ago

Problem not exist always is dependency by logger. Sample example

php -r 'openlog("myScriptLog", 0, LOG_LOCAL0); syslog(LOG_INFO, str_repeat("x ", 60000));'

metalog truncate to 4096 signs.

m-kress commented 4 years ago

Currently you can't configure the length of the log entries. Unfortunatelly they are hardcoded by a define in metalog.h:

define MAX_LOG_LENGTH 8192U

So you would have to change that and recompile :-(

tczaude commented 4 years ago

Hi Thanks for answer. I'am blind :/ Patch and recompile is not problem i use Funtoo :) i change this value end nothing happend this same result :( I propably see problem with buffer. When i increse array size buffer metalog stop loging above command.

m-kress commented 4 years ago

You are right. Even the buffer[] in process_log() is hard coded. This might be the reason, why the original authors limited it: https://tools.ietf.org/html/rfc5426#section-3.2

It might be worth a try:

Increase the buffer array size
Increase MAX_LOG_LENGTH to at least the same value like buffer size
modify the while loop, so it looks like the while loop for the kernel log a few lines below), so it wont overwrite already read data. Use a new variable like bpos to position the next read in the buffer array.

I have no idea, why the syslog read is handled differently than the kernel log read. There must be a reason...

m-kress commented 11 months ago

There seems to be no more need for longer log entries. My personal view: a log line longer than 4096 characters is no log entry any more. In case there really is so much information, it most probably is a good idea to break it down to separate lines. If there is's no other opinion, I will close this issue very soon.

m-kress commented 5 months ago

Closed, as mentioned (not as "soon" as originally thought :-)