PlaybookMessages cut off, duplicated or showing the wrong host
When to use this: Long log lines are truncated, folders are named wrongly, or messages appear twice.
Steps
-
Raise the maximum message size
terminalsudo nano /etc/rsyslog.confAdd
global(maxMessageSize="64k")near the top of the main config (before modules and inputs are loaded), then runsudo rsyslogd -N1and restart. Long firewall log lines can exceed small defaults. -
Prefer TCP for long messages
Over UDP, a long message may be split by the network (fragmentation) or dropped. TCP delivers long messages reliably.
-
Use the sender IP, not the header hostname
Wrong or blank host names are common because many devices do not put a proper hostname in the syslog header. The rsyslog example on this site names folders by
%fromhost-ip%for that reason. -
Find duplicates
The same event appearing twice usually means two syslog destinations pointing to the same server (for example
syslogdandsyslogd2on a FortiGate), or a client that both forwards and is also forwarded by a relay. Remove the extra path.
How to verify it worked
- Full-length lines appear and each sender has exactly one folder.
Common errors and fixes
Q&A
Why are my long logs cut?
A size limit in the server (maxMessageSize), the sender or the transport. Raise the server limit and use TCP.
Why use the IP address instead of the hostname for folders?
The IP is always known to the server. Header hostnames are often missing or wrong on network devices.