util/debug: increase max length of message

[regit]

Ticket: 7419

Contribution style:

• I have read the contributing guide lines at
  https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html

Our Contribution agreements:

• I have signed the Open Information Security Foundation contribution agreement at
  https://suricata.io/about/contribution-agreement/ (note: this is only required once)

Changes (if applicable):

• I have updated the User Guide (in doc/userguide/) to reflect the changes made
• I have updated the JSON schema (in etc/schema.json) to reflect all logging changes
  (including schema descriptions)
• I have created a ticket at
  https://redmine.openinfosecfoundation.org/projects/suricata/issues

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7419

Describe changes:

• Increase max length for log message

SV_REPO=OISF/suricata-verify#2152

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 49.97%. Comparing base (287d836) to head (6f15524).
Report is 7 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #12183      +/-   ##
==========================================
- Coverage   49.98%   49.97%   -0.02%     
==========================================
  Files         912      912              
  Lines      257066   257066              
==========================================
- Hits       128503   128476      -27     
- Misses     128563   128590      +27     

Flag	Coverage Δ
fuzzcorpus	60.97% <100.00%> (-0.01%)	⬇️
livemode	19.41% <100.00%> (+<0.01%)	⬆️
pcap	44.41% <100.00%> (+0.01%)	⬆️
suricata-verify	62.70% <100.00%> (-0.02%)	⬇️
unittests	9.01% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

Information:

ERROR: QA failed on SURI_TLPR1_alerts_cmp.

field	baseline	test	%
	SURI_TLPR1_stats_chk
.app_layer.flow.dcerpc_tcp	40	42	105.0%

Pipeline 23608

[jasonish]

I can't think of any problems here. Many many apps log much bigger messages - think stack traces, etc.

[victorjulien]

Can you explain the why in the git message?

[victorjulien]

where does the 256 come from?

[regit]

It was a guess but I've been overly optimistic because if we look at the failure message for a signature, we have in fact inside of the log message error parsing signature {{SIG}} from file {{FILE}}. It we take the full log wihtout the SIG and FILE, we have 265 chars (512 for a round count).
So it we want to be strict we need in fact

#define SC_LOG_MAX_LOG_MSG_LEN 8192 + PATH_MAX + 512

PATH_MAX is usually 4092.

Should I switch to that ?

[regit]

Replaced by #12192