syslog msg size

[Lars Erik Gullerud]

On Thu, 24 Feb 2005, Mike Sturdee wrote:

> In trying to receive syslog(3) messages longer than 1024 bytes with 
> syslog-ng, I'm noticing FreeBSD's library function syslog(3) is the only 
> syslog implementation besides Solaris limited to 1024.. Has removing this 
> limitation ever been considered?

Well, 1024 bytes is the max length specified in RFC 3164:

4.1 syslog Message Parts

    The full format of a syslog message seen on the wire has three
    discernable parts.  The first part is called the PRI, the second part
    is the HEADER, and the third part is the MSG.  The total length of
    the packet MUST be 1024 bytes or less.  There is no minimum length of
    the syslog message although sending a syslog packet with no contents
    is worthless and SHOULD NOT be transmitted.

Now, 3164 is of course only an Informational RFC, but breaking it can 
obviously still have potential compatibility issues.

/leg