[GH-ISSUE #1826] SyslogUdp logs gets truncated #779

New issue

Open

opened 2026-03-04 02:17:54 +03:00 by kerem · 1 comment

kerem commented

2026-03-04 02:17:54 +03:00

Owner

Originally created by @dirkam on GitHub (Aug 2, 2023).
Original GitHub issue: https://github.com/Seldaek/monolog/issues/1826

Monolog version 2.9.1 in a Laravel 9 environment on Ubuntu 22.
I use the SyslogUdpHandler to send logs via Syslog to third-party systems.

It works, but when the log message is longer, then it gets truncated. What can be the reason for this, and is there a way to not have it truncated?

If I log the message just before the socket_sendto($this->getSocket(), $chunk, strlen($chunk), $flags = 0, $this->ip, $this->port); call in UdpSocket.php, then I still see the correct length.

However, if I monitor it with tcdump, what I see is a single packet and that the message is truncated when it gets sent over:
<134>1 2023-08-02T12:45:41+00:00 myhost myapp 65630 - - Lorem ipsum dolor sit amet, consectetur adipiscing elit. Maecenas placerat justo ut imperdiet fringilla. Nam nec mauris ut ligula scelerisque lobortis laoreet quis nulla. Mauris malesuada augue lorem, a volutpat eros varius sit amet. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos. Suspendisse tincidunt in dolor non consequat. Morbi congue ipsum porta arcu eleifend condimentum. Mauris tincidunt, mi ac suscipit consequat, magna diam accumsan augue, id tristique ex mauris vitae mauris. Fusce nec ipsum eros. Donec condimentum, sapien ut interdum pharetra, nisl est vehicula purus, quis sagittis magna purus eget leo. Duis dapibus nulla vel diam volutpat ullamcorper. Pellentesque scelerisque, orci eget dictum consequat, arcu magna fringilla eros, eget eleifend orci lectus et mi. Interdum et malesuada fames ac ante ipsum primis in faucibus. Proin nec lorem fringilla enim semper sollicitudin. Proin non convallis

Since the actual log message is a JSON, it can't be parsed on the receiver if it's not complete.

Originally created by @dirkam on GitHub (Aug 2, 2023). Original GitHub issue: https://github.com/Seldaek/monolog/issues/1826 Monolog version 2.9.1 in a Laravel 9 environment on Ubuntu 22. I use the SyslogUdpHandler to send logs via Syslog to third-party systems. It works, but when the log message is longer, then it gets truncated. What can be the reason for this, and is there a way to not have it truncated? If I log the message just before the `socket_sendto($this->getSocket(), $chunk, strlen($chunk), $flags = 0, $this->ip, $this->port);` call in `UdpSocket.php`, then I still see the correct length. However, if I monitor it with tcdump, what I see is a single packet and that the message is truncated when it gets sent over: ` <134>1 2023-08-02T12:45:41+00:00 myhost myapp 65630 - - Lorem ipsum dolor sit amet, consectetur adipiscing elit. Maecenas placerat justo ut imperdiet fringilla. Nam nec mauris ut ligula scelerisque lobortis laoreet quis nulla. Mauris malesuada augue lorem, a volutpat eros varius sit amet. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos. Suspendisse tincidunt in dolor non consequat. Morbi congue ipsum porta arcu eleifend condimentum. Mauris tincidunt, mi ac suscipit consequat, magna diam accumsan augue, id tristique ex mauris vitae mauris. Fusce nec ipsum eros. Donec condimentum, sapien ut interdum pharetra, nisl est vehicula purus, quis sagittis magna purus eget leo. Duis dapibus nulla vel diam volutpat ullamcorper. Pellentesque scelerisque, orci eget dictum consequat, arcu magna fringilla eros, eget eleifend orci lectus et mi. Interdum et malesuada fames ac ante ipsum primis in faucibus. Proin nec lorem fringilla enim semper sollicitudin. Proin non convallis ` Since the actual log message is a JSON, it can't be parsed on the receiver if it's not complete.

kerem added the

Bug

label

2026-03-04 02:17:54 +03:00

kerem commented

2026-03-04 02:17:55 +03:00

Author

Owner

@Seldaek commented on GitHub (Oct 27, 2023):

There is a 64K limit (DATAGRAM_MAX_LENGTH). I'm not sure what you can do here, except use another format or log less data.

@Seldaek commented on GitHub (Oct 27, 2023): There is a 64K limit (DATAGRAM_MAX_LENGTH). I'm not sure what you can do here, except use another format or log less data.