fluent-bit icon indicating copy to clipboard operation
fluent-bit copied to clipboard

Default for skip_long_lines should be ON -or- Long Lines should truncate

Open edinel opened this issue 5 months ago • 0 comments

In current defaults, skip_long_lines is set to OFF.

This means that if a log file has a log line which exceeds the buffer_max_size, Fluent Bit will stop monitoring that file entirely.

This suggests that if someone could maliciously write a long log line to a file (e.g. /var/log/security or /var/log/messages , they could then take actions which are logged into that file without fear that Fluent Bit would properly route those messages to a place in which they were being monitored.

Better behavior would be to truncate long log lines, rather than simply skip them. (indeed, this is the default behavior I might naively expect)

edinel avatar Jun 05 '25 00:06 edinel