# Centralized Rsyslog : Max Size of Message

In a centralized `rsyslog` setup, managing the maximum size of log messages is important to ensure that large messages do not cause issues with performance or storage. `rsyslog` has configuration options that allow you to control and manage message size.

### Configuring Max Size of Messages in Rsyslog

### 1. **Setting the Maximum Message Size**

You can configure the maximum size of messages in `rsyslog` by setting the `maxMessageSize` parameter. This parameter specifies the maximum size of a message that `rsyslog` will accept.

**Edit the Rsyslog Configuration File**

1. Open the `rsyslog` configuration file for editing. You can edit the main configuration file or create a custom configuration file under `/etc/rsyslog.d/`.
    
    ```bash
    sudo nano /etc/rsyslog.conf
    ```
    
    or
    
    ```bash
    sudo nano /etc/rsyslog.d/99-custom.conf
    ```
    
2. Add or modify the following line to set the maximum message size. The value is specified in bytes:
    
    ```
    $MaxMessageSize 1000000
    ```
    
    In this example, the maximum message size is set to 1,000,000 bytes (approximately 1 MB).
    
3. Save and exit the editor.
4. Restart `rsyslog` to apply the changes:
    
    ```bash
    sudo systemctl restart rsyslog
    ```
    

### 2. **Handling Large Messages**

If you expect very large messages, consider configuring `rsyslog` to handle them properly:

- **Log Splitting**: Ensure that the logging application is configured to split large messages if needed. This is often handled by the application generating the logs.
- **Message Truncation**: Configure `rsyslog` to truncate messages that exceed the maximum size. By default, `rsyslog` will discard messages that exceed the configured size limit.

### 3. **Monitoring and Troubleshooting**

- **Check Logs for Errors**: Monitor `rsyslog` logs for any errors related to message sizes. These logs can help you identify if messages are being discarded or if there are any configuration issues.
    
    ```bash
    sudo tail -f /var/log/syslog
    ```
    
- **Adjust Size Limits as Needed**: Depending on the volume and size of messages, you might need to adjust the `MaxMessageSize` parameter to balance performance and log management.

### Example of Complete Configuration

Here's an example configuration snippet that sets a maximum message size and handles other basic settings:

```
# Set maximum message size to 1 MB
$MaxMessageSize 1000000

# Additional configuration settings
module(load="imudp") # For UDP input
input(type="imudp" port="514")

module(load="omfile") # For file output
action(type="omfile" file="/var/log/remote.log")

# Handle messages from a specific application
if $programname == 'myapp' then /var/log/myapp.log
& ~

```

In this example, messages are handled with a maximum size of 1 MB, and specific messages are routed to designated log files.

### Additional Notes

- **Performance Considerations**: Be mindful of the impact of large messages on `rsyslog` performance. Very large messages can affect processing and storage efficiency.
- **Documentation**: For more details on configuring `rsyslog` and handling large messages, refer to the [rsyslog documentation](https://www.rsyslog.com/doc/).

By configuring the maximum message size and handling large messages appropriately, you can ensure that your centralized `rsyslog` setup remains efficient and manageable.