Outbound syslog messages truncated at 1024 bytes in size
Article ID: 42632
Updated On:
Products
Issue/Introduction
The CA API Management Gateway is capable of leveraging the BSD Syslog protocol for transmitting audit and log records to external sources for storage and analysis. The specification for this protocol stipulates a limit of 1024 bytes per packet. This would result in overall messages greater than that value being truncated. It may not be immediately clear that the Gateway is truncating the outbound Syslog messages until a detailed examination of an expected message occurs
For example, the Lorem ipsum filler text can be used to define a message with a discrete size and composition. A Gateway is configured to audit a message containing the Lorem ipsum text with three repetitions. If this is performed with the Add Audit Details assertion then the following Syslog message would appear:
INFO com.l7tech.log.custom.lorem: -4: Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. Lorem ipsum dolor sit amet, consectetur a
The primary point of emphasis is formatted in italics and it indicates that the third iteration of the Lorem ipsum text is truncated too quickly.
Environment
Component: APIGTW
Resolution
This can be avoided and resolved by adjusting a particular system property: com.l7tech.server.log.syslog.maxLength. This property can be added to /opt/SecureSpan/Gateway/node/default/etc/conf/system.properties and accepts an integer value representing the number of bytes allowed in an outbound Syslog message. Changing this property requires a full Gateway appliance restart. Upon making a sufficient change with the example above, the following log should be recorded:
INFO com.l7tech.log.custom.lorem: -4: Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
Note that the full text of the third repetition is now present.
Feedback
