Actually, the UDP size limitation is mentioned as the lowest "must be supported" message size in the syslog UDP transport mapping RFC5426 for exactly the reasons Assaf pointed out. But the RFC strongly recommends using higher sizes. HOWEVER, if you are doing *network management* and use UDP, you better make sure that everything fits in ~400 bytes because the likelyhood of loosing fragmented messages in a broken network (or one under attack) is considerably higher than for non-fragmented ones. Maybe (I am guessing here) that was the motivation for logger developers.
In practice, much larger UDP messages are no problem, but again keep the broken network use case on your mind. When we wrote these RFCs we got sufficient feedback that this could become a problem in practice. Rainer On Mon, Feb 10, 2014 at 11:08 PM, David Lang <da...@lang.hm> wrote: > On Mon, 10 Feb 2014, Assaf Gordon wrote: > > On 02/10/2014 04:56 PM, David Lang wrote: >> >>> >>> fragmentation works on UDP messages into packets, and UDP packets can be >>> any size up to the MTU of your network. so you can send a 4k message >>> over UDP without using jumbo packets. >>> >>> >> I agree with everything you wrote about UDP, but it was not the point of >> my original post. >> >> My point was, after some testing and experimentation, I found that using >> "logger" with "-u" parameter, the messages will be truncated to 400 bytes >> with most implementations, regardless of 'rsyslogd' . >> >> The reason for that limitation is likely UDP, but this reason is mostly >> off-topic. >> >> The take-home message is that if one wants longer messages, AND is using >> "logger -u", he/she will need a patched version of "logger". >> > > Ok, identifying limits in logger is very good to do. It sounded like you > were saying that those were the limits of using UDP for logs perion, not > the limits of using UDP with logger. > > David Lang > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
