SyslogUdp logs gets truncated
dirkam opened this issue · comments
Monolog version 2.9.1 in a Laravel 9 environment on Ubuntu 22.
I use the SyslogUdpHandler to send logs via Syslog to third-party systems.
It works, but when the log message is longer, then it gets truncated. What can be the reason for this, and is there a way to not have it truncated?
If I log the message just before the socket_sendto($this->getSocket(), $chunk, strlen($chunk), $flags = 0, $this->ip, $this->port); call in UdpSocket.php, then I still see the correct length.
However, if I monitor it with tcdump, what I see is a single packet and that the message is truncated when it gets sent over:
<134>1 2023-08-02T12:45:41+00:00 myhost myapp 65630 - - Lorem ipsum dolor sit amet, consectetur adipiscing elit. Maecenas placerat justo ut imperdiet fringilla. Nam nec mauris ut ligula scelerisque lobortis laoreet quis nulla. Mauris malesuada augue lorem, a volutpat eros varius sit amet. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos. Suspendisse tincidunt in dolor non consequat. Morbi congue ipsum porta arcu eleifend condimentum. Mauris tincidunt, mi ac suscipit consequat, magna diam accumsan augue, id tristique ex mauris vitae mauris. Fusce nec ipsum eros. Donec condimentum, sapien ut interdum pharetra, nisl est vehicula purus, quis sagittis magna purus eget leo. Duis dapibus nulla vel diam volutpat ullamcorper. Pellentesque scelerisque, orci eget dictum consequat, arcu magna fringilla eros, eget eleifend orci lectus et mi. Interdum et malesuada fames ac ante ipsum primis in faucibus. Proin nec lorem fringilla enim semper sollicitudin. Proin non convallis
Since the actual log message is a JSON, it can't be parsed on the receiver if it's not complete.
There is a 64K limit (DATAGRAM_MAX_LENGTH). I'm not sure what you can do here, except use another format or log less data.