syslog msg size

[Mike Sturdee]

On Fri, 25 Feb 2005, Lars Erik Gullerud wrote:

> On Thu, 24 Feb 2005, Mike Sturdee wrote:
>
>> In trying to receive syslog(3) messages longer than 1024 bytes with 
>> syslog-ng, I'm noticing FreeBSD's library function syslog(3) is the only 
>> syslog implementation besides Solaris limited to 1024.. Has removing this 
>> limitation ever been considered?
>
> Well, 1024 bytes is the max length specified in RFC 3164:
>
> 4.1 syslog Message Parts
>
>   The full format of a syslog message seen on the wire has three
>   discernable parts.  The first part is called the PRI, the second part
>   is the HEADER, and the third part is the MSG.  The total length of
>   the packet MUST be 1024 bytes or less.  There is no minimum length of
>   the syslog message although sending a syslog packet with no contents
>   is worthless and SHOULD NOT be transmitted.
>
> Now, 3164 is of course only an Informational RFC, but breaking it can 
> obviously still have potential compatibility issues.
>
> /leg
>
>

Thanks for the info.

-Mike