/ limit

Modifying Rsyslog syslogtag length limit

Introduction

Some of you may know about an issue with rsyslog and sending messages from a client to a central rsyslog server.
There is a default built-in forwarding template in rsyslog which limits its length to 32 characters. Recently we encountered this as an issue while we have some service names which are longer.

I managed to get a "fixed" forwarding template running and want to give you the quite easy solution here.

The new default forwarding template for Rsyslog nodes

Create the new forwarding template which is almost the same as the built-in except for the removed legth limitation

$template LongTagForwardFormat,"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%"

Apply the new Forwarding Template as the default

$ActionForwardDefaultTemplate LongTagForwardFormat

Send everything to central logserver now via TCP

*.*     @@centrallog.example.com:514