scalyr/scalyr-agent-2

Where in the config does message_size_can_exceed_tcp_buffer override go?

ju2wheels opened this issue · 1 comments

Im using scalyr/scalyr-agent-docker-syslog:2.1.10 Docker image and we have some syslog agents that gather local logs and a few for Docker defined as follows:

root@host:/etc/scalyr-agent-2/agent.d# cat docker.json 
{
  "monitors": [
    {
      "docker_regex": "^.*([a-z0-9]{12})\\[\\d+\\]: ",
      "mode":         "docker",
      "module":       "scalyr_agent.builtin_monitors.syslog_monitor",
      "protocols":    "tcp:601",
      "message_size_can_exceed_tcp_buffer": true
    },
    {
      "module":   "scalyr_agent.builtin_monitors.docker_monitor",
      "log_mode": "syslog",
      "report_container_metrics": false
    }
  ]
}
root@host:/etc/scalyr-agent-2/agent.d# cat logs.json 
{
  "logs": [
    {
      "path": "/var/log/scalyr-agent-2/agent.log",
      "attributes": {
        "parser": "scalyrAgentLog"
      }
    },
    {
      "path": "/var/log/scalyr-agent-2/agent_syslog.log",
      "attributes": {
        "parser": "agentSyslog"
      }
    },
    {
      "path": "/var/log/scalyr-agent-2/containers/*.log",
      "attributes": {
        "parser": "agentSyslogDocker"
      }
    }
  ]
}
root@host:/etc/scalyr-agent-2/agent.d# cat rsyslog.json 
{
  "monitors": [
    {
      "module":                    "scalyr_agent.builtin_monitors.syslog_monitor",
      "protocols":                 "tcp:602",
      "accept_remote_connections": true,
      "message_size_can_exceed_tcp_buffer": true
    }
  ]
}

However we are still seeing the following when our host side rsyslog agent forwards logs > 8k in size to port 602:

Apr 22 16:17:32 host rsyslogd: omfwd: TCPSendBuf error -2027, destruct TCP Connection to 127.0.0.1:602 [v8.32.0 try http://www.rsyslog.com/e/2027 ]
Apr 22 16:17:32 host scalyr[19053]: 2022-04-22 16:17:32.633Z WARNING [monitor:syslog_monitor] [syslog_monitor.py:538] Syslog frame exceeded maximum buffer size
Apr 22 16:17:32 host docker-compose[10653]: scalyr-agent      | 2022-04-22 16:17:32.633Z WARNING [monitor:syslog_monitor] [syslog_monitor.py:538] Syslog frame exceeded maximum buffer size
Apr 22 16:17:32 host rsyslogd: action 'action 1' resumed (module 'builtin:omfwd') [v8.32.0 try http://www.rsyslog.com/e/2359 ]

Closing this, I just realized this option wasnt added until 2.1.14, so its an agent version issue.