rsyslog接入mysql排错 2025-01-25 网络 暂无评论 107 次阅读 #Data too long for column 连续三个错误如下     ``` action 'action-0-ommysql' (module 'ommysql') message lost, could not be processed. Check for additional error messages before this one. ommysql: db error (1406): Data too long for column 'SysLogTag' at row 1 The error statement was: insert into SystemEvents(Message,Facility,FromHost,Priority,DeviceReportedTime,ReceivedAt,InfoUnitID,SysLogTag)values() ``` 经分析最终原因就是SysLogTag列过小,输入的数据过大,导致不能写入Mysql。 解决方案: 打开数据库表,修改SysLogTag varchar 60为255。  #imfile error. message received is larger than max msg size; message will be split and processed as another message  经分析该错误提示为接收消息太大,需要被分割。 官方关于消息大小的说法如下: ``` $MaxMessageSize , default 8k - allows to specify maximum supported message size (both for sending and receiving). The default should be sufficient for almost all cases. Do not set this below 1k, as it would cause interoperability problems with other syslog implementations. Important: In order for this directive to work correctly, it must be placed right at the top of rsyslog.conf (before any input is defined). Change the setting to e.g. 32768 if you would like to support large message sizes for IHE (32k is the current maximum needed for IHE). I was initially tempted to set the default to 32k, but there is a some memory footprint with the current implementation in rsyslog. If you intend to receive Windows Event Log data (e.g. via EventReporter), you might want to increase this number to an even higher value, as event log messages can be very lengthy (“$MaxMessageSize 64k” is not a bad idea). Note: testing showed that 4k seems to be the typical maximum for UDP based syslog. This is an IP stack restriction. Not always … but very often. If you go beyond that value, be sure to test that rsyslogd actually does what you think it should do ;) It is highly suggested to use a TCP based transport instead of UDP (plain TCP syslog, RELP). This resolves the UDP stack size restrictions. Note that 2k, is the smallest size that must be supported in order to be compliant to the upcoming new syslog RFC series. ``` https://www.rsyslog.com/doc/configuration/global/index.html 解决方案: rsyslog.conf中: 在$ModLoad imtcp前,配置: ``` $MaxMessageSize 64k ``` 此配置包括发送和接收,所以rsyslog客户端、服务端都要设置。 配置的长度可根据业务需求决定设置为32k或64k。 如果配置更大,需要注意Mysql中该字段大小,text类型默认为64k,可修改成更大数据库类型。  标签: mysql, rsyslog 本作品采用 知识共享署名-相同方式共享 4.0 国际许可协议 进行许可。