Syslog messages are truncated when received from VMware Cloud Director

Products

• VMware Cloud Director

Issue/Introduction

• VMware Cloud Director has been configured to deliver syslog messages to a centralized logging server, as detailed in the following document:
  
  Enabling Centralized Logging in VMware vCloud Director
  
  
• Syslog messages appear as truncated in the logging aggregator.
• The message sizes do not exceed the maximum message size for the logging server, as in the following behavior for Aria Operations for Logs:
  
  VMware Cloud Director logs are truncated in Aria Operations for Logs

Environment

VMware Cloud Director 10.x

Cause

If the end to end network MTU between the source and the destination is not consistent, packets can be fragmented and cause the message from being accurately assembled at the destination log aggregator. Moreover, if there is a syslog relay, there are circumstances where messages may be truncated, which can result in similar symptoms.

Resolution

Confirm that there is a consistent end-to-end MTU in the network path between VMware Cloud Director and the log aggregator.

Additional Information

Please note, since syslog message are delivered using UDP, which is a connectionless protocol, additional issues can be encountered as network utilization and scale increases. This could include dropped packets during congestion, since the packets would not be retransmitted, changes in packet order due to traversal of different paths, etc.