tags:

views:

71

answers:

1

Most Unix programmers would be used to the interface defined by syslog.h, and many implementations (such as glibc) have no real limit on the size of the syslog message being sent to it, but there is usually a limit on the application listening to /dev/log.

I'm wondering if anyone knows a way to find the maximum message size for the syslog? Or some good documentation of what the limit actually (or usually) is?

Edit:

So far I've found these RFCs on the topic:

+1  A: 

Keep in mind syslog is a protocol, which means it sets minimums and makes recommendations. I can't find a source to this, but I believe the minimum length that should be supported is 1k, with 64k being recommended.

Each implementation is free to do what they want, i.e. if you wanted a 16MB maximum and were writing a syslog server, you're free to do that. I'm not sure why you would, but you could.

As far as I know, there is no standard programatic way of ascertaining this, so keeping messages at just under 1k would be ideal for portability.

Tim Post
Yeah exactly - is there anything out there that documents this 1k, 64k, 16mb thing? Even if I can't figure it out in a programatic way, it would be good to document where this random constant is coming from in the code.
Petriborg
Of course I should have realized there is an RFC(s) about syslog - http://www.faqs.org/rfcs/rfc5426.html - http://www.faqs.org/rfcs/rfc3164.html So I guess that will do
Petriborg
@Petriborg - Its implementation specific, but no standard means exist to ascertain the limit. You could (perhaps) start writing in multiples of 1k chunks until syslog() fails at configure time to figure it out but that's just icky, your logging routines still have to break it down into chunks, which is even more icky. What you can't send to syslog .. just send to a logfile and reference it in syslog? I can't find a consensus on if a message that exceeds the limit will be truncated or just rejected, either.
Tim Post