Return
-
Title
syslog-ng PE Drop Packets Under A Specific Size -
Description
Drop messages under a specific size. -
Cause
How to drop messages under a specific size? -
Resolution
In order to have syslog-ng drop messages under a specific size, the variable flags(store-raw-message) must be set for sources to make RAWMSG available first.
Create a filter. For example:
filter f_length { "$(length ${RAWMSG})" > "50" };
Now add the new filter to your log statement. For example:
log {
source(s_srv2016);
filter(f_length);
destination(d_srv2016); };