Where in the config does message_size_can_exceed_tcp_buffer override go?
ju2wheels opened this issue · 1 comments
ju2wheels commented
Im using scalyr/scalyr-agent-docker-syslog:2.1.10
Docker image and we have some syslog agents that gather local logs and a few for Docker defined as follows:
root@host:/etc/scalyr-agent-2/agent.d# cat docker.json
{
"monitors": [
{
"docker_regex": "^.*([a-z0-9]{12})\\[\\d+\\]: ",
"mode": "docker",
"module": "scalyr_agent.builtin_monitors.syslog_monitor",
"protocols": "tcp:601",
"message_size_can_exceed_tcp_buffer": true
},
{
"module": "scalyr_agent.builtin_monitors.docker_monitor",
"log_mode": "syslog",
"report_container_metrics": false
}
]
}
root@host:/etc/scalyr-agent-2/agent.d# cat logs.json
{
"logs": [
{
"path": "/var/log/scalyr-agent-2/agent.log",
"attributes": {
"parser": "scalyrAgentLog"
}
},
{
"path": "/var/log/scalyr-agent-2/agent_syslog.log",
"attributes": {
"parser": "agentSyslog"
}
},
{
"path": "/var/log/scalyr-agent-2/containers/*.log",
"attributes": {
"parser": "agentSyslogDocker"
}
}
]
}
root@host:/etc/scalyr-agent-2/agent.d# cat rsyslog.json
{
"monitors": [
{
"module": "scalyr_agent.builtin_monitors.syslog_monitor",
"protocols": "tcp:602",
"accept_remote_connections": true,
"message_size_can_exceed_tcp_buffer": true
}
]
}
However we are still seeing the following when our host side rsyslog agent forwards logs > 8k in size to port 602:
Apr 22 16:17:32 host rsyslogd: omfwd: TCPSendBuf error -2027, destruct TCP Connection to 127.0.0.1:602 [v8.32.0 try http://www.rsyslog.com/e/2027 ]
Apr 22 16:17:32 host scalyr[19053]: 2022-04-22 16:17:32.633Z WARNING [monitor:syslog_monitor] [syslog_monitor.py:538] Syslog frame exceeded maximum buffer size
Apr 22 16:17:32 host docker-compose[10653]: scalyr-agent | 2022-04-22 16:17:32.633Z WARNING [monitor:syslog_monitor] [syslog_monitor.py:538] Syslog frame exceeded maximum buffer size
Apr 22 16:17:32 host rsyslogd: action 'action 1' resumed (module 'builtin:omfwd') [v8.32.0 try http://www.rsyslog.com/e/2359 ]
ju2wheels commented
Closing this, I just realized this option wasnt added until 2.1.14, so its an agent version issue.