In JSA, the default UDP payload length has a default configuration of 1024. Historically, this has been fine, however, a few years ago RFC requirements changed allowing larger payload lengths. If Vendors have modified their syslog length and JSA receives them, then the payload will be truncated, resulting in the inability to parse the events as they are missing the right bracket signaling the end of the payload. These events go to Stored or Sim Generic and often cause performance problems on the box. JunOS is taking advantage of the longer payload lengths.

truncated events

performance degradation notifications

Double the payload length.

Go to Admin > System Settings > Click Advanced > Max UDP Syslog Payload Length. Change the value from 1024 to 2048.

Note: Changing this value can affect searching performance. You may need to adjust the value lower to balance search performance versus truncation.