syslog(3) single line length limit

[Lew Pitcher]

Current environment:
Slackware Linux 32bit 13.0
sysklogd v1.4.1
glibc v2.9b

I've encountered some odd artifacts in the contents of my syslog. I have a
custom program that writes to syslog data generated by a script's stdout.

The custom program demarshalls stream data from a pipe into lines, and
writes each line (from start of buffer to first newline) in a syslog(3)
call. On occasion, I see certain lines split across syslog line boundaries,
and/or spurious blank lines. Like...

id1: PREP: usb_backup: clean, 9222/39075840 files, 28161313/78142160 blocks
id1: PREP: (check in 4 mounts)
and
id2: POST: usb_backup: clean, 9222/39075840 files, 28158224/78142160 blocks
id2: POST: (check in 3 mounts)
id2: POST:

(NB: I've (obviously) shortened the lines for inclusion here, by dropping
the date/time stamp, the systemname, and the program id. I note that, with
a longer ID, the lines /seem/ to break at a different place than the ones
with a shorter ID. This may be a /clue/.)

I've both walked through the demarshalling/logging logic, /and/ examined the
other line output written to syslog through syslog(3), and can't find any
error with the code. I'll continue to examine this avenue, and may post an
example of the code later.

However, it occurs to me that syslog(3) (and the underlying syslogd(8)
logging daemon) may have built-in line-length limits that cause /syslogd/
to fold the data written in single syslog(3) calls into multiple lines in
the syslog target file (in this case /var/log/messages).

The problem is that neither the syslog(3) manpage nor the syslogd(8) manpage
mention such a line-folding behaviour, and do not note any syslog(3)
line-length limits.

So, is anyone out there familiar with Linux syslog enough to tell me if and
what the line length limit is?

Thanks in advance
--
Lew Pitcher
"In Skills, We Trust"

[Rainer Weikusat]

Lew Pitcher <lpit...@teksavvy.com> writes:

[...]

IIRC (I would need to check this with the 'BSD syslog RFC' which I
can't easily do at the moment), the limit for the syslog network
protocol is 1024 bytes. But it should be fairly easy to debug this,
ie, by additionally writing all data sent to the logger to a file. If
the output in the file is correct, either the syslog C library
routine(s) or the syslog daemon is munging your data. Otherwise, it is
obviously an error in the code generating the input.