Syslog data from UDP. Maximum message size?

[eject]

What's maximum message size which splunk's syslog will accept via UDP? How I can increase it?

[BenAveling]

This sounds like a UDP problem, not a splunk problem.

For me, anything up to 65507 bytes is received (and truncated to 10000 bytes). Anything longer just gets lost.

If you have perl, maybe try sending to the following script and seeing what happens:

my $usage = qq{Usage:
  perl udp_server.pl port
};

use strict;

use IO::Socket;

my $port=shift or die "port not specified\n\n$usage";

my $response = IO::Socket::INET->new(Proto=>"udp",LocalPort=>$port)
  or die "Can't make UDP server: $@";

my $message=0;

while(1){
  print "Listening on $port...\n";
  my ($datagram,$flags);
  $response->recv($datagram,100000,$flags) or warn "recv failed: $!\n";
  print "Got message ",++$message," from ", $response->peerhost,", flags ",$flags || "none",": $datagram\n", "length: ",length $datagram,"\n";
}

[hazekamp]

Splunk uses the TRUNCATE setting in props.conf to determine maximum message size. By default this is set to 10000 bytes.

## props.conf.spec
TRUNCATE = <non-negative integer>
* Change the default maximum line length (in bytes).
* Although this is in bytes, line length is rounded down when this would
  otherwise land mid-character for multi-byte characters.
* Set to 0 if you never want truncation (very long lines are, however, often a sign of
  garbage data).
* Defaults to 10000 bytes.

[dwaddle]

I might suggest trying to run strace on splunk's calls to recv(). You'll want to make sure that the buffer size passed to recv() is big enough to receive the whole datagram in one call.

[eject]

I've set TRUNCATE = 0 in C:\Program Files\Splunk\etc\system\default\props.conf and restarted Splunk. tried to send 2600 bytes and it don't displayed :(.

With wireshark I see that that messages reached server.

All messages which are smaller than 1900 bytes displays just fine. How can I debug this problem ?