Find Syslog Max Message Length

Find syslog max message length

Keep in mind syslog is a protocol, which means it sets minimums and makes recommendations. I can't find a source to this, but I believe the minimum length that should be supported is 1k, with 64k being recommended.

Each implementation is free to do what they want, i.e. if you wanted a 16MB maximum and were writing a syslog server, you're free to do that. I'm not sure why you would, but you could.

As far as I know, there is no standard programatic way of ascertaining this, so keeping messages at just under 1k would be ideal for portability.

Update

User MuMind indicated in comments that rsyslog truncated at 2097 characters, including log type / time stamp. As it is a widely used implementation of the protocol, this reinforces that length should be kept to between 1k - 1.5k for maximum portability.

Honestly, the only reason to exceed that would be to log additional debug / crash output; it's much better to put that somewhere in /var/log instead, and just indicate that you did so when talking to syslog (granted, there are scenarios when you couldn't, but plenty of libraries have 'best effort' logging built in to deal with that).

Does Syslog really have a 1KB message limit?

This is correct, as can be seen in the syslog protocol RFC. This, and other deficiencies in the syslog protocol, is the reason why modern syslog daemons such as rsyslog support enhanced protocols with features such as TCP transport, encryption etc. There was also some effort within the IETF to standardize an improved syslog protocol, which resulted in RFC5424, RFC5425, and RFC 5426. Here, the minimum maximum message size is relatively small (depending on the transport layer), however implementations are allowed to support larger messages as well.

Python syslog logger can't write more than 2048 chars

rsyslogd limits to 2048 bytes per message by default, but you can set it using $MaxMessageSize parameter in /etc/rsyslog.conf:

$MaxMessageSize , default 2k - allows to specify maximum
supported message size (both for sending and receiving).

Reference: http://www.rsyslog.com/doc/v8-stable/configuration/global/index.html

How to increase php syslog maximum limit of 2048

The 2K limit might come from rsyslog, too (it's the default limit). You should be able to change it with something like:

$MaxMessageSize 10k

And put it somewhere at the beginning of the config:

Centralized rsyslog : max size of message

I found the solution.

The parameter :

$MaxMessageSize 20k

must be set before network declaration (at the top of rsyslog.conf file) :

$ModLoad imtcp
$InputTCPServerRun 1514

Find Syslog Max Message Length