syslog(3) and truncated messages.

[Ian Lepore]

On Tue, 2013-11-12 at 23:00 +0100, Edward Tomasz Napierała wrote:
> I have a daemon (namely ctld(8)) that, when running with debug enabled,
> outputs a lot of information to the syslog, using the usual syslog(3) API.
> Problem is, the output gets truncated: at some point the log messages
> from all involved processes stop getting logged, even though the processes
> continue to run, confirmed by subsequent kernel messages, which get logged
> properly.
> 
> Any idea what might be going on?
> 

There is a long-standing problem with buffer allocation in syslogd.  It
allocates tiny socket buffers and burst of high-volume logging often
just loses most of the packets.  I filed a pr and a patch years ago [1],
but it probably won't apply cleanly anymore.  Oddly enough I was
thinking just a few days ago about getting it cleaned up and committing
it myself, I just haven't had time since it occurred to me.  We've been
using it at $work for years so it's well-tested.

[1] http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/160433

-- Ian