Question

Most Unix programmers would be used to the interface defined by syslog.h, and many implementations (such as glibc) have no real limit on the size of the syslog message being sent to it, but there is usually a limit on the application listening to /dev/log.

I’m wondering if anyone knows a way to find the maximum message size for the syslog? Or some good documentation of what the limit actually (or usually) is?

Edit:

So far I’ve found these RFCs on the topic:

• http://www.faqs.org/rfcs/rfc3164.html
• http://www.faqs.org/rfcs/rfc5426.html

Answer 1

Keep in mind syslog is a protocol, which means it sets minimums and makes recommendations. I can’t find a source to this, but I believe the minimum length that should be supported is 1k, with 64k being recommended.

Each implementation is free to do what they want, i.e. if you wanted a 16MB maximum and were writing a syslog server, you’re free to do that. I’m not sure why you would, but you could.

As far as I know, there is no standard programatic way of ascertaining this, so keeping messages at just under 1k would be ideal for portability.

Update

User MuMind indicated in comments that rsyslog truncated at 2097 characters, including log type / time stamp. As it is a widely used implementation of the protocol, this reinforces that length should be kept to between 1k – 1.5k for maximum portability.

Honestly, the only reason to exceed that would be to log additional debug / crash output; it’s much better to put that somewhere in /var/log instead, and just indicate that you did so when talking to syslog (granted, there are scenarios when you couldn’t, but plenty of libraries have ‘best effort’ logging built in to deal with that).