Ok, I think I get a sense of who is doing what which results in the Large Message getting Split as per my understanding it's LINE_MAX value in the `journalctl` conf that causes the Large message to get split.
The default value is 48K and compared to the size of the split message and it comes approx to 48K. Now that explains that I'm thinking is there a way to prepend any "IDENTIFIER" for the message that was split from the original message? so that we can reassemble/merge them at the central Logstash server.
I'm looking at the correct section of code, https://github.com/systemd/systemd/blob/main/src/journal/journald-stream.c#L498 I don't think there exists anything like it. Still want to check if there is anything possible?
Thanks
On Mon, May 22, 2023 at 4:44 AM Virendra Negi <virendra.negi@xxxxxxxxxxxxxxxxxxxx> wrote:
> Syslog was never really intended for large size messages. It is not Windows event log.
> If you are sending large complex things then using dbus to communicate directly
> is a better option.Now I'm bit prepexled uptil now I was under the impression that the large message is getting split as a result of systemd, I still believe that is the case but apparently the rsyslog team had told me that they dont support splitting.I just want to know how?
On Sunday, May 21, 2023, Michael Biebl <mbiebl@xxxxxxxxx> wrote:Am So., 21. Mai 2023 um 18:26 Uhr schrieb Stephen Hemminger
<stephen@xxxxxxxxxxxxxxxxxx>:
> Syslog was never really intended for large size messages. It is not Windows event log.
> If you are sending large complex things then using dbus to communicate directly
> is a better option.
dbus is not a suitable protocol for large amounts of data and high
frequency of events.
Disclaimer: This e-mail and any documents, files, or previous e-mail messages appended or attached to it may contain confidential and/or privileged information. If you are not the intended recipient (or have received this email in error) please notify the sender immediately and delete this e-mail. Any unauthorized copying, disclosure or distribution of the material in this email is strictly prohibited & unlawful. The recipient acknowledges that Margo Networks Private Limited (SugarBox) may be unable to exercise control or ensure or guarantee the integrity of the text of the email message and the text is not warranted as to completeness and accuracy. Before opening and accessing the attachment, if any, please check and scan for virus
