PHP :: Request #23229 :: syslog function truncates messages

syslog function truncates messages

Submitted:

2003-04-15 15:20 UTC

Modified:

2010-02-26 18:17 UTC

Votes:	11
Avg. Score:	4.6 ± 0.5
Reproduced:	11 of 11 (100.0%)
Same Version:	6 (54.5%)
Same OS:	9 (81.8%)

From:

cassano at monroe dot net

Assigned:

aharvey (profile)

Status:

Closed

Package:

Feature/Change Request

PHP Version:

5.2.10

OS:

Linux 2.4.18-27

Private report:

CVE-ID:

None

[2003-04-15 15:20 UTC] cassano at monroe dot net

The PHP syslog function is truncating messages longer than 500 characters which is currently stopping our ability to respond to error states in our multi-logging environment(i.e. things other than PHP).

Please change this to something more appropiate like 16384 bytes.


Here is the PHP syslog function.

/* {{{ proto bool syslog(int priority, string message)
   Generate a system log message */
PHP_FUNCTION(syslog)
{
    long priority;
    char *message;
    int message_len;

    if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ls", &priority,
                              &message, &message_len) == FAILURE) {
        return;
    }

    /*
     * CAVEAT: if the message contains patterns such as "%s",
     * this will cause problems.
     */

    php_syslog(priority, "%.500s", message);
    RETURN_TRUE;
}
/* }}} */

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2010-02-26 13:34 UTC] pickscrape at gmail dot com

Happens in PHP 5.2.10 too. This limit is short enough to make most 
backtraces completely useless.

[2010-02-26 13:57 UTC] mbtaylor at gmail dot com

I have experienced this in all PHP versions > 5. It makes backtraces pointless and code quite frustrating to debug.

[2010-02-26 16:04 UTC] aharvey@php.net

Looking into this; although my preliminary feeling is this isn't a restriction in PHP as such.

[2010-02-26 17:00 UTC] aharvey@php.net

From the point of view of the syslog() function (the original subject of this bug), PHP imposes no restrictions on the size of the syslog message. I've tested it with syslog-ng configured to accept large (>1k, which is beyond the spec limit) log messages, and it works fine. So that's fixed, presumably by the fix for bug #36689 -- any problems with direct calls to syslog() having truncated messages are being caused by the syslog daemon, not PHP.

Over IRC, pickscrape confirmed that he/she is actually using error_log = syslog, not the syslog() function. That has a different code path. (Of course.)

At present, there's a hard-coded 500 character limit (PHP_5_3 has it at line 571 of main/main.c, should anyone wish to gaze at it), which matched what used to be in syslog() before bug #36689 was fixed. Since syslog() hasn't had that limit in almost four years and nobody's complained about it breaking their syslogd, it should be safe to remove it here as well. The patches at the end of this post will do just that.

With the patch applied, there's still another limit. Happily, this one's already configurable. Because this is going through the standard error handling machinery, the log_errors_max_len INI setting will then take effect. By default, this will limit the message to 1k. Therefore, anyone wanting to send really big error messages to syslog will want to bump that as well.

So, the patches:

PHP_5_2: http://adamharvey.name/patches/bug-23229-5.2.patch
PHP_5_3: http://adamharvey.name/patches/bug-23229-5.3.patch
Trunk:   http://adamharvey.name/patches/bug-23229-trunk.patch

[2010-02-26 17:02 UTC] aharvey@php.net

Side note: I can't convince the bug tracker to let me deassign myself and mark this as open again. If someone with SVN karma could commit the patches in the previous comment, I'd rather appreciate that. :)

[2010-02-26 18:17 UTC] aharvey@php.net

This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.