查找系统日志最大消息长度 [英] Find syslog max message length
问题描述
大多数Unix程序员都习惯使用 syslog.h 定义的接口，许多实现(例如glibc)对发送给它的syslog消息的大小没有实际限制，但是通常，监听/dev/log 的应用程序受到限制.
Most Unix programmers would be used to the interface defined by syslog.h, and many implementations (such as glibc) have no real limit on the size of the syslog message being sent to it, but there is usually a limit on the application listening to /dev/log.
我想知道是否有人知道找到系统日志最大消息大小的方法?还是一些关于实际(或通常)限制是多少的好的文档?
I'm wondering if anyone knows a way to find the maximum message size for the syslog? Or some good documentation of what the limit actually (or usually) is?
到目前为止，我已经在以下主题上找到了这些RFC:
So far I've found these RFCs on the topic:
推荐答案
请紧记syslog是一个协议，这意味着它设置了最小值并提出了建议.我找不到源，但是我相信应该支持的最小长度是1k，建议使用64k.
Keep in mind syslog is a protocol, which means it sets minimums and makes recommendations. I can't find a source to this, but I believe the minimum length that should be supported is 1k, with 64k being recommended.
每个实现都可以自由地执行他们想要的操作，即，如果您希望最大为16MB并正在编写syslog服务器，则可以自由地执行该操作.我不确定为什么会这么做，但是可以.
Each implementation is free to do what they want, i.e. if you wanted a 16MB maximum and were writing a syslog server, you're free to do that. I'm not sure why you would, but you could.
据我所知，尚没有确定此问题的标准 programmatic 方法，因此将消息保持在1k以下对于可移植性来说是理想的选择.
As far as I know, there is no standard programatic way of ascertaining this, so keeping messages at just under 1k would be ideal for portability.
更新
用户 MuMind 在注释中指出， rsyslog 被截断为2097个字符，包括日志类型/时间戳.由于它是该协议的广泛使用的实现，因此这加强了长度，应保持在1k-1.5k之间，以实现最大的可移植性.
User MuMind indicated in comments that rsyslog truncated at 2097 characters, including log type / time stamp. As it is a widely used implementation of the protocol, this reinforces that length should be kept to between 1k - 1.5k for maximum portability.
老实说，超出该限制的唯一原因是记录其他调试/崩溃输出；最好将其放在/var/log 中，并指出在与syslog交谈时您这样做了(当然，在某些情况下，您可能无法，但是许多库都内置了尽力而为"的记录来处理该问题).
Honestly, the only reason to exceed that would be to log additional debug / crash output; it's much better to put that somewhere in /var/log instead, and just indicate that you did so when talking to syslog (granted, there are scenarios when you couldn't, but plenty of libraries have 'best effort' logging built in to deal with that).
这篇关于查找系统日志最大消息长度的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
