java.nio.BufferOverflowException with syslog probe transactions on midserverIssue The ServiceNow Syslog probe uses the MID Server to deliver log messages from a ServiceNow instance to another machine, such as a dedicated log server, using the syslog protocol over an IP network. This KB talks about a situation where few syslog ecc queue output records are not processed by midserver and throw the below exception in midserver agent log === Worker-Standard:Syslog-4ab9cbf61b40689070dca7d23b4bcb0e SEVERE * ERROR * java.nio.BufferOverflowExceptionat java.nio.CharBuffer.put(CharBuffer.java:922)at java.nio.CharBuffer.put(CharBuffer.java:950)at com.service_now.mid.probe.syslog.Syslogger.genMsg(Syslogger.java:136)at com.service_now.mid.probe.syslog.Syslogger.log(Syslogger.java:51)at com.service_now.mid.probe.Syslog.probe(Syslog.java:89)at com.service_now.mid.probe.AProbe.process(AProbe.java:104)at com.service_now.mid.queue_worker.AWorker.runWorker(AWorker.java:122)at com.service_now.mid.queue_worker.AWorkerThread.run(AWorkerThread.java:20)at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)at java.lang.Thread.run(Thread.java:748) =====CauseUpon checking MID Server host machine, there is enough memory available. MID Server JVM memory size is been increased from 1024 to 2048 and restarted MID server service but this didn't resolve the problem. The root cause is, the syslog implementation on the MID server has a message size limitation of 1500 characters. This is by design to fit in a single UDP packet since the default MTU size is 1500. Unfortunately, this limit is hardcoded and cannot be configured.ResolutionThe workaround is to have whatever flow sending the syslog transactions to the MID server truncate the message to 1500 characters. This should allow midserver to process the syslog records successfully