• State Suggested Answer
  • Replies reply
    1
  • Answers answer
    1
  • Subscribers subscribers
    23
  • Views views
    179
  • Users 0 members are here

Field [rawEvent] truncated Limit

rduarte


Hey guys.

I have a syslog connector with problems processing an event with more than 4000 bytes, how can I solve this?

I knew that adding the following parameters would solve it.

size.validation.fields and size.validation.sizes to 10,000

Is there any possibility of corrupting the logger or ESM database by getting an event with more than 4000 bytes there?

  • Suggested Answer

    0

    Hello  ,

    If you modify the connector's parameter to not truncate events to fit to ArcSight Database, then this will be done on destination(s) - ESM and/or logger. This is a self-healing process that prevents database corruption. Like all other processes, this will also allocate some resources and you may notice some ESM or logger performance degradation.

    I hope I answered your question.

    Mladen

Resources

Support
Documentation
Learning Services
Partner Programs
Privacy
Compliance
Help
Company
Privacy Policy
Terms of Use
Cookies Preferences
Accessibility
Anti-Slavery Statement
Support
Contact Us
Careers
Code of Business Conduct and Ethics
The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.