AEM as a Cloud Service: Missing Splunk log entries due to log line length limits
✨ This content is AI generated and could be inaccurate. Generative AI Terms
This article describes why certain log entries are missing from Splunk when log lines in Adobe Experience Manager as a Cloud Service exceed the maximum supported length, and provides guidance on how to avoid this issue.
Description description
Environment
Adobe Experience Manager as a Cloud Service (all versions)
Symptoms
Some log entries are missing from Splunk when using log forwarding from AEM as a Cloud Service. Log lines that are very long (for example, over 32 KB) do not appear in either Adobe’s logs or in downstream Splunk instances. Other log lines before and after the long entry are collected and forwarded as expected.
Cause
AEM as a Cloud Service’s log collector has a maximum supported log line length of approximately 32 KB (32,766 bytes). Log lines exceeding this limit are skipped completely and not forwarded to Splunk. Log lines between 8,500 bytes and 32 KB are truncated to include only the beginning and end of the message, with a notice inserted indicating truncation.
Resolution resolution
Follow the steps below to resolve the issue:
- Review your application’s logging logic to ensure that individual log lines do not exceed 8,500 characters.
- When logging lists or large objects, log only the total count and a sample of entries, or split the data into multiple log lines.
- If you must log large data sets, batch or segment the output so that each log line remains well below the 8,500 character threshold (for example, log up to 50 items per line and continue in subsequent lines).
- If you encounter missing log entries, check the size of the original log line in your application’s logs. If it exceeds 32 KB, it will be skipped entirely by the AEM log collector and will not appear in Splunk.
- For log lines between 8,500 bytes and 32 KB, expect to see truncated messages with a notice indicating the message was too long and truncated.
Verify that after making these changes, all necessary log entries appear in Splunk as expected.