Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!de-l.enfer-du-nord.net!feeder2.enfer-du-nord.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Rainer Weikusat <rweikusat@mssgmbh.com>
Newsgroups: comp.os.linux.development.apps
Subject: Re: syslog(3) single line length limit
Date: Mon, 16 Jul 2012 03:38:55 +0100
Lines: 45
Message-ID: <87r4sctoow.fsf@sapphire.mobileactivedefense.com>
References: <DgKMr.50125$iI7.48837@newsfe03.iad>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Trace: individual.net BH5UQZdy97oDm8gOWzTmFwPrAw1YkybLbm4t3uiJIfKFtujqRC5KXdGSQKkoeDzBM=
Cancel-Lock: sha1:SJPvW2PkiA0Dfd+3N2bgWGctslg= sha1:BkJUh2kVYedgNUm78OAF7Ea/lxE=
User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.2 (gnu/linux)
Xref: csiph.com comp.os.linux.development.apps:498

Lew Pitcher <lpitcher@teksavvy.com> writes:

[...]

> The custom program demarshalls stream data from a pipe into lines, and
> writes each line (from start of buffer to first newline) in a syslog(3)
> call. On occasion, I see certain lines split across syslog line boundaries,
> and/or spurious blank lines. Like...
>
>  id1: PREP: usb_backup: clean, 9222/39075840 files, 28161313/78142160 blocks
>  id1: PREP:  (check in 4 mounts)
> and
>  id2: POST: usb_backup: clean, 9222/39075840 files, 28158224/78142160 blocks
>  id2: POST:  (check in 3 mounts)
>  id2: POST:
>
> (NB: I've (obviously) shortened the lines for inclusion here, by dropping
> the date/time stamp, the systemname, and the program id. I note that, with
> a longer ID, the lines /seem/ to break at a different place than the ones
> with a shorter ID. This may be a /clue/.)
>
> I've both walked through the demarshalling/logging logic, /and/ examined the
> other line output written to syslog through syslog(3), and can't find any
> error with the code. I'll continue to examine this avenue, and may post an
> example of the code later.
>
> However, it occurs to me that syslog(3) (and the underlying syslogd(8)
> logging daemon) may have built-in line-length limits that cause /syslogd/
> to fold the data written in single syslog(3) calls into multiple lines in
> the syslog target file (in this case /var/log/messages).
>
> The problem is that neither the syslog(3) manpage nor the syslogd(8) manpage
> mention such a line-folding behaviour, and do not note any syslog(3)
> line-length limits.
>
> So, is anyone out there familiar with Linux syslog enough to tell me if and
> what the line length limit is?

IIRC (I would need to check this with the 'BSD syslog RFC' which I
can't easily do at the moment), the limit for the syslog network
protocol is 1024 bytes. But it should be fairly easy to debug this,
ie, by additionally writing all data sent to the logger to a file. If
the output in the file is correct, either the syslog C library
routine(s) or the syslog daemon is munging your data. Otherwise, it is
obviously an error in the code generating the input.