Forum Discussion

Ian_Johnson_382's avatar
Ian_Johnson_382
Icon for Nimbostratus rankNimbostratus
Jun 09, 2009

Maximum message size using logging profiles

Hi All,

 

 

Does anyone know what the maximum log message size when using a Logging Profile (9.4.7). It would seem that it can only send around 2k worth of the message, so cutting off some of the larger messages.

 

 

If the size is limited to 2k, can it be increased?

 

 

I've tried playing around with the log_msg_size setting in syslog-ng.conf but I believe the message is being sent by the bd process which appears to ignore any syslog settings.

 

 

This may be more of a F5 Support question but I thought I would ask here first.

 

 

Thanks

 

Ian
app sec
BIG-IP Access Policy Manager (APM)
security
  • Benjamin_9036's avatar
    Benjamin_9036
    Historic F5 Account
    Jun 10, 2009
    Hey Ian!

     

     

    The maximum possible size for remote logging messages is 2048 bytes when using the RFC 3195 protocol. You're correct that the remote logging for ASM is controlled by ASM rather than the system's normal syslog configuration.

     

     

    I believe that the size limitations are imposed by the protocol - at least the non 3195 limitations certainly are. As I recall the RFC 3195 update was ambiguous as to size restrictions, but many implementations will still only read 2048 bytes. If you have a case where your servers will definitely accept more than this, then it is worth opening a case with F5 Networks Support to request an enhancement to the remote logging for cases in which you *know* you can handle more than 2k.

     

     

    Cheers!

     

     

    // Ben
  • Ido_Breger_3805's avatar
    Ido_Breger_3805
    Historic F5 Account
    Dec 03, 2009
    not sure that this is the same problem... the previous problem was with ASM 9.4.X truncating syslog messages larger than 2K, you say that you have messages less than 2K being truncated.

     

     

    BTW, with ASM V10.X, ASM can log up to 64KB via syslog.
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Dec 03, 2009
    I assume when you say 'log x.x.x.x $string-to-send' you're referring to an iRule. If so, this is not going through ASM. That would use TMM to send the syslog message directly to a remote syslog server. As far as I'm aware, the log remote iRule command only supports UDP messages.

     

     

    See Deb's article on this option:

     

     

    iRules Update: The "log" command gets new options

     

    http://devcentral.f5.com/Default.aspx?tabid=63&articleType=ArticleView&articleId=190

     

     

    Aaron