7.7. Increase Rsyslog buffer size

The Rsyslog buffer is configured by default to 128k. That means that the log size that ingests is 128k. If a log is bigger than that, the log is truncated.

To increase the log buffer, if it is necessary, we need to go to the following file:

vi /etc/rsyslog.conf

We need to change the following variable with the value we want to put:

$MaxMessageSize 128k

• $MaxMessageSize <size_nbr>:- allows to specify maximum supported message size (both for sending and receiving). The default should be sufficient for almost all cases. Do not set this below 1k, as it would cause interoperability problems with other syslog implementations.

Finally, we need to restart the service:

systemctl restart rsyslog