What is the maximum message size in centralized rsyslog?

Rsyslog's documented default maximum input message size is 8 KB, configurable with maxMessageSize. That is a receiver setting, not a guarantee that an application, relay, transport, and destination will all accept the same size.

The legacy RFC 3164 format describes a maximum of 1,024 bytes for the whole message, including its header. RFC 5424 does not impose that same universal ceiling: transport requirements and implementation limits matter. A long event may be truncated, rejected, or split along the route, depending on the component and its configuration.

Increase the receiver's limit

Set this near the start of the main rsyslog configuration, before the inputs that use it:

global(maxMessageSize="64k")

The equivalent legacy directive is an alternative, not an additional setting:

$MaxMessageSize 64k

Validate the combined configuration before restarting:

sudo rsyslogd -N1
sudo systemctl restart rsyslog

Some input modules have their own size controls. Check those along with any relay's settings. Larger limits also increase the memory required for queued messages.

Check the entire path

Use TCP or RELP for large events when both ends support it. Large UDP datagrams can require IP fragmentation; losing one fragment can lose the message. TCP removes that datagram constraint, but it does not remove application limits or solve mismatched message framing.

A multiline stack trace should be assembled into a single event at collection time when that is your intended event boundary. It still needs a sufficient byte limit and a transport framing method that preserves embedded newlines. Combining lines does not make a large event smaller.

FAQ

Can a truncated event be recovered?

Not from the truncated copy. Look for the original application file or an upstream archive, identify the first hop that shortened it, and correct that hop before replaying.

How can I test the limit?

Send a non-sensitive synthetic message with a known byte length and a unique marker at the end. Compare the original and received payload, excluding added syslog headers. Repeat below and above the proposed threshold, including multibyte text. Confirm that the test sender itself allows the chosen message size.

References: rsyslog global settings, RFC 3164, and RFC 5424.