syslog plugin truncates log messages on long queries

[Patrick Crews]

The syslog plugin is truncating log messages if the query is too long:

full message:
Sep 2 20:02:29 mahmachine drizzled[4340]: thread_id=4 query_id=113982 db="test" query="SELECT table1 . `col_int_key` AS field1 FROM e AS table1 LEFT JOIN d AS table2 LEFT OUTER JOIN o AS tab
le3 ON table2 . `pk` = table3 . `col_int` ON table1 . `pk` = table3 . `pk` WHERE table1 . `pk` != 1 ORDER BY field1 ASC" command="Query" t_connect=1283472149416207 t_start=508 t_lock=374 rows_sent=5 rows_examined=11 tmp_table=0 total_warn_count=0

Sep 2 20:02:29 mahmachine drizzled[4340]: thread_id=4 query_id=113980 db="test" query="SELECT table4 . `col_int` AS field1 , table1 . `col_int_key` AS field2 , table1 . `col_int` AS field3 , table2 . `col_int` AS field4 , table3 . `col_int` AS field5 , COUNT( table2 . `col_int_key` ) AS field6 , table2 . `pk` AS field7 , table1 . `col_int_key` AS field8 , table2 . `col_int_key` AS field9 , table1 . `pk` AS field10 , MAX( table2 . `col_int` ) AS field11 FROM a AS table1 RIGHT OUTER JOIN g AS table2 ON table1 . `col_int_key` = table2 . `col_int_key` RIGHT OUTER JOIN b AS table3 LEFT JOIN c AS table4 LEFT OUTER JOIN o AS table5 LEFT JOIN k AS table6 ON table5 . `col_int_key` = table6 . `col_int_key` ON table4 . `col_varchar_10_key` = table5 . `col_varchar_1024_key` LEFT OUTER JOIN m AS table7 RIGHT JOIN p AS table8 LEFT JOIN m AS table9 ON table8 . `col_varchar_1024_key` = table9 . `col_varchar_10_key` ON table7 . `col_int_key` = table9 . `pk` ON table6 . `pk` = table7 . `pk` ON table3 . `col_varchar_1024` = table6 . `col_varchar_10_key` RIGHT OUTER JOIN j AS table10 ON table3 . `col_varchar_10` = table10 . `col_
varchar_10` ON table1 . `col_varchar_10_key` = table7 . `col_varchar_1024` LEFT JOIN o AS table11 RIGHT OUTER JOIN f AS table12 RIGHT JOIN j AS table13 RIGHT JOIN a AS table14 LEFT JOIN g AS table15 RIGHT JOIN e AS table16 ON table15 . `col_int` = table16 . `col_int_key` ON table14 . `col_varchar_1024_key` = table16 . `col_varchar_1024_key` ON table13 . `col_varchar_10_key` = table14 . `col_varchar_10_key` ON table12 . `col_varchar_10` = table15 . `col_varchar_1024_key` ON table11 . `col_varchar_1024_key` = table13 . `col_varchar_1024_key` LEFT JOIN a AS table17 RIGHT JOIN k AS table18 LEFT OUTER JOIN l AS table19 RIGHT JOIN n AS table20 LEFT JOIN d AS table21 ON table20 . `col_int_key` = table21 . `col_int_key` ON table19 . `pk` = table21 . `pk` ON table18 . `col_varchar_10_key` = table21 . `col_varchar_10

[Patrick Crews (patrick-crews)]

I can provide a proper test case if that would help - just let me know. That beast of a query was generated via randgen and could be a pita to do by hand : )

[Patrick Crews (patrick-crews)]

It could be that this isn't due to the syslog plugin, but rather a result of rsyslog's configuration for $MaxMessageSize

If this is the case, we need to document it.