Does Syslog really have a 1KB message limit?

2019-03-12 05:55发布

It seems Syslog has a 1KB message limit. Is this hardcoded into the Syslog protocol, or is this a parameter that can be set for each server?

I am hoping the article I read was out of date, so if you have any info please share.

标签: syslog
3条回答
一夜七次
2楼-- · 2019-03-12 06:42

This is correct, as can be seen in the syslog protocol RFC. This, and other deficiencies in the syslog protocol, is the reason why modern syslog daemons such as rsyslog support enhanced protocols with features such as TCP transport, encryption etc. There was also some effort within the IETF to standardize an improved syslog protocol, which resulted in RFC5424, RFC5425, and RFC 5426. Here, the minimum maximum message size is relatively small (depending on the transport layer), however implementations are allowed to support larger messages as well.

查看更多
爷、活的狠高调
3楼-- · 2019-03-12 06:42

Yes, but you can increase this limit to an arbitrary length by recompiling from source.

See instructions in this blog post I found about truncated syslog messages: http://bsdpants.blogspot.com/2010/08/truncated-syslog-messages.html

查看更多
smile是对你的礼貌
4楼-- · 2019-03-12 06:49

From my reading of the syslog protocol spec (well, draft standard), message packets can't be more than 1KiB, but (using a fragmentation feature) messages can be. RFC 5424, however, says message size depends on transport, but is at least 480 octets.

查看更多
登录 后发表回答