[BUG] 🔥 LogMonitor crashes wrapped process on log line > 4000 characters. This is happening in production ATM

[buckleyGI]

Describe the bug
When a wrapped process outputs a log line longer than ~4000 characters, LogMonitor crashes the wrapped process instead of handling the line gracefully.

To Reproduce
Steps to reproduce the behavior:

1. Create a Windows container and install LogMonitor

2. Wrap a process using:

   SHELL ["C:\\LogMonitor\\LogMonitor.exe", "cmd", "/S", "/C"]
   

3. Inside the process, output a long line (e.g.):

   Write-Output ("A" * 5000)

4. Observe: LogMonitor crashes and the container exits

Expected behavior
LogMonitor should handle long log lines safely — either truncating, splitting, or forwarding them — without crashing the wrapped process.

Screenshots
N/A — reproducible via script

Configuration

• Tool: LogMonitor

• Version: Latest Log Monitor Version 2.1.1 commit d36c314

• Environment:

  • Windows Server Core base image
  • Kubernetes on Windows

Additional context
No visible error or stack trace. Likely caused by buffer/encoding limits when forwarding stdout. High impact for any apps producing verbose or dynamic logs.
This line is my prime suspect and if you know cpp maybe it is obvious.

---

[buckleyGI]

We did a test with a buffer of 40960 instead of 4096.
This 10 fold increase make LogMonitor stable in our production as we manually tested it.
Can you, for now, mitigate the issue by releasing a new V2.1.2 version with this increase buffer.
We donwload the exe from github at numerous places.
ADD 'https://github.com/microsoft/windows-container-tools/releases/download/v2.1.1/LogMonitor.exe' 'C:\LogMonitor\LogMonitor.exe'
This would already help us for now! Thank you

[buckleyGI]

The line in case is this one

windows-container-tools/LogMonitor/src/LogMonitor/ProcessMonitor.cpp

Line 10 in fb712c3

#define BUFSIZE 4096

[buckleyGI]

@iankingori Can you please confirm that it's reproducible at your end? Otherwise we have to dog deeper in our setup. I think it's quite easy to trigger no?

[iankingori]

@iankingori Can you please confirm that it's reproducible at your end? Otherwise we have to dog deeper in our setup. I think it's quite easy to trigger no?

Hey @buckleyGI , I have successfully repro'd the issue, we are working on a patch and should release soon. I noticed the character limit is about 4052, with the additional JSON characters taking up the rest of the buffer

[CharityKathure]

The fix has been merged but is pending inclusion in the next release. Will close once the release is complete and verified.

[buckleyGI]

Thank you 🙏 Is this a matter of days or will the new release wait for other new features? I need to know if I need to take mitigation steps on our end.

[buckleyGI]

@CharityKathure Is this release still planned for this week? Thank you for letting us know.

[buckleyGI]

@iankingori just checking in — is the release still planned any time soon? Would appreciate an update if possible. We prepared for mitigation steps in the meantime. Thanks!

[bobsira]

We are working on a release, we are aiming for an early next week release.