Hi Rainer, confirm it is related to messages not having LF on the end. Problem is reported on the second syslog relay. It is caused by messages being split on the first row relay due to exceeding size limit. The first part of the splitted message is not terminated with LF. Both relays use the same size limit for received messages, therefore all the messages reported on relay2 start with <PRI>.
Is there any possibility to let rsyslog add the LF on the end of the message once splitted? Thank you. -- Peter On Tue, Sep 8, 2020 at 10:07 AM Rainer Gerhards <[email protected]> wrote: > This smells like incorrect framing (no LF at end of message). > > Rainer > > El mar., 8 sept. 2020 a las 9:48, Peter Viskup via rsyslog > (<[email protected]>) escribió: > > > > Getting following strange messages on our syslog servers: > > > > > > Sep 8 06:02:03 syslog01 rsyslogd: imptcp bo-t: message received is at > > least 2001 byte larger than max msg size; message will be split starting > > at: " <13>1 2020-09-08T06:02:03.25764" [v8.1901.0] > > > > > > Not getting them all the time. > > > > Any idea what could be causing this? > > > > Thank you. > > > > > > -- > > > > Peter > > _______________________________________________ > > rsyslog mailing list > > https://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
