[systemd-devel] Splitting large message written to stdout, explanation?

[Lennart Poettering]

On Mo, 22.05.23 09:31, Virendra Negi (virendra.negi at sugarboxnetworks.com) wrote:

> Ok, I think I get a sense of who is doing what which results in the Large
> Message getting Split as per my understanding it's *LINE_MAX* value in the
> `journalctl` conf that causes the Large message to get split.
>
> The default value is 48K and compared to the size of the split message and
> it comes approx to 48K. Now that explains that I'm thinking *is there** a
> way to prepend any "IDENTIFIER"  for the message that was split* from the
> original message? so that we can reassemble/merge them at the central L
> *ogstash* server.
>
> I'm looking at the correct section of code,
> https://github.com/systemd/systemd/blob/main/src/journal/journald-stream.c#L498
> I
> don't think there exists anything like it. Still want to check if there is
> anything possible?

As mentioned you can use the _LINE_BREAK= field to reassemble the
lines. But seriously, if you are logging megabytes of data in single
log messages you are doing things wrong. Rivisit what you are doing
there, you are trying to hammer a square log message into a round log
transport. Bad idea.

Lennart

--
Lennart Poettering, Berlin