From owner-freebsd-current@FreeBSD.ORG  Fri Feb 25 17:55:39 2005
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2950416A516
	for <current@FreeBSD.org>; Fri, 25 Feb 2005 17:55:39 +0000 (GMT)
Received: from electra.nolink.net (electra.nolink.net [195.139.204.207])
	by mx1.FreeBSD.org (Postfix) with ESMTP id EF3E343D53
	for <current@FreeBSD.org>; Fri, 25 Feb 2005 17:55:28 +0000 (GMT)
	(envelope-from lerik@nolink.net)
Received: (qmail 15195 invoked by uid 1000); 25 Feb 2005 17:55:27 -0000
Received: from localhost (sendmail-bs@127.0.0.1)
  by localhost with SMTP; 25 Feb 2005 17:55:27 -0000
Date: Fri, 25 Feb 2005 18:55:27 +0100 (CET)
From: Lars Erik Gullerud <lerik@nolink.net>
To: Mike Sturdee <sturdee@pathwaynet.com>
In-Reply-To: <20050224190926.Y41330@sun.mikesweb.com>
Message-ID: <20050225185200.I13634@electra.nolink.net>
References: <20050224190926.Y41330@sun.mikesweb.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
cc: current@FreeBSD.org
Subject: Re: syslog msg size
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 25 Feb 2005 17:55:39 -0000

On Thu, 24 Feb 2005, Mike Sturdee wrote:

> In trying to receive syslog(3) messages longer than 1024 bytes with 
> syslog-ng, I'm noticing FreeBSD's library function syslog(3) is the only 
> syslog implementation besides Solaris limited to 1024.. Has removing this 
> limitation ever been considered?

Well, 1024 bytes is the max length specified in RFC 3164:

4.1 syslog Message Parts

    The full format of a syslog message seen on the wire has three
    discernable parts.  The first part is called the PRI, the second part
    is the HEADER, and the third part is the MSG.  The total length of
    the packet MUST be 1024 bytes or less.  There is no minimum length of
    the syslog message although sending a syslog packet with no contents
    is worthless and SHOULD NOT be transmitted.

Now, 3164 is of course only an Informational RFC, but breaking it can 
obviously still have potential compatibility issues.

/leg