There were a couple of bugs, I think imfile proprably did not abide the max size. But even if it would split the message, the json content would be damaged.
Sent from phone, thus brief. Am 25.10.2017 21:05 schrieb "Randall Diffenderfer" < rdiffender...@proofpoint.com>: > that's my point — i am trying to figure out what i can do … > > at the moment i am trying to reconcile my "cloudy" memory of message > splitting. i thought that did occur in certain i/o paths, so i was > surprised to see a pure truncation in the imfile path. > > From: Rainer Gerhards <rgerha...@hq.adiscon.com> > Date: Wednesday, October 25, 2017 at 11:57 > To: Randall Diffenderfer <rdiffender...@proofpoint.com> > Cc: rsyslog-users <rsyslog@lists.adiscon.com> > Subject: Re: [rsyslog] handling oversized messages > > Yeah but if they are too large... They are. Especially with json payload, > what will you do against this? > > Rainer > > Sent from phone, thus brief. > > Am 25.10.2017 20:51 schrieb "Randall Diffenderfer" < > rdiffender...@proofpoint.com>: > >> i suppose i deserved that… :-) >> >> however, i have to interoperate with other folks who can't/won't increase >> N … >> >> so, i am pegged at their "N" in order to see no data corruption, as the >> messages are structured, in that they are json, and busting them up will be >> a bit problematic… >> >> From: Rainer Gerhards <rgerha...@hq.adiscon.com> >> Date: Wednesday, October 25, 2017 at 11:33 >> To: rsyslog-users <rsyslog@lists.adiscon.com> >> Cc: Randall Diffenderfer <rdiffender...@proofpoint.com> >> Subject: Re: [rsyslog] handling oversized messages >> >> It may sound dumb, but: increase n! That's why this setting exists. >> >> Rainer >> >> Sent from phone, thus brief. >> >> Am 25.10.2017 19:48 schrieb "Randall Diffenderfer via rsyslog" < >> rsyslog@lists.adiscon.com>: >> >>> >>> given the global setting of "maxmessagesize=N", what is my recourse if i >>> need to process a message > N in imfile? >>> >>> in other i/o modules? it appears the message is truncated at ~N, and not >>> split (which is what i thought i had seen in the past...) >>> >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_mailman_listinfo_rsyslog&d=DwMFaQ&c=Vxt5e0Osvvt2gflwSlsJ5DmPGcPvTRKLJyp031rXjhg&r=9sXs16LkSD1MzhoJxgyl7R_tait1dEXqvyD3NCT1wEA&m=0d7WauHwvHvrFWs0bcAWNNxOtvaCSn7-izMA1oDTedw&s=Y2aZ4XynKrB4wgg_Y21Tuh5VisfzrJe4cTVcQkFfBow&e=> >>> http://www.rsyslog.com/professional-services/ >>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_professional-2Dservices_&d=DwMFaQ&c=Vxt5e0Osvvt2gflwSlsJ5DmPGcPvTRKLJyp031rXjhg&r=9sXs16LkSD1MzhoJxgyl7R_tait1dEXqvyD3NCT1wEA&m=0d7WauHwvHvrFWs0bcAWNNxOtvaCSn7-izMA1oDTedw&s=iK9krYQbWQ66DQXmXGuvorYG28Ioqr9mIroDehsBFLM&e=> >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerhards&d=DwMFaQ&c=Vxt5e0Osvvt2gflwSlsJ5DmPGcPvTRKLJyp031rXjhg&r=9sXs16LkSD1MzhoJxgyl7R_tait1dEXqvyD3NCT1wEA&m=0d7WauHwvHvrFWs0bcAWNNxOtvaCSn7-izMA1oDTedw&s=0XCzqR0TiMEj5d53jKXtPEmzmNe0C3xpAV8fiGXFyq4&e=> >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >> _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
