RE: syslog-protocol Discussion

[Rainer Gerhards <rgerhards@hq.adiscon.com>]

Happy new year to all! I am finally back from an extended holiday season
(January 6th is also a holidy over here) and I fear I will be posting
some responses today... ;)

> Rainer has proposed adding "metadata" as a field in the
> protocol (formerly
> called "cookies")

I count this as a vote for the term "metadata" and will assume this
issue is solved when nobody objects it ;)

> for specific information to be included in
> the syslog
> packet.  There has been some discussion about this:
>
>   http://www.mail-archive.com/syslog-sec%40employees.org/msg01346.html
>
> with many follow-up responses.
>
> It looks like the consensus is
>
> - the idea may be a good one.
> - the format may need some tweaking.
> - saying that it "looks" like XML is a bad thing.
>
> I'm going to ask Rainer to add this idea into the
> syslog-protocol ID at
> this time with inputs from the Working Group.

I agree that some text needs to be written ASAP, but I fear the current
discussion needs to be finished in the regard whether we will actually
use XML or not. I am posting a specific message very soon after this one
- just to keep the message more focused. I think it is vitally important
to finish that part of the discussion because without that, no good text
can be written - not even a "draft for a draft" simply because I do not
know where we are actually heading to... Read on in the next message ;)

> I'd like for this
> discussion to continue on the mailing list as well.  Hopefully we can
> resolve things on the mailing list.  I'm also going to call
> for a meeting
> in Seoul to give us a deadline for this discussion.

I like this "dealine idea" very much. I unfrotunately can not attend
Seoul personally, but I hope we can prepare many things in advance to
make it a good experience..

> It looks like
> syslog-protocol is fairly well finished with the exception of
> this item
> and the TAG issue raised by Albert.

Actually, I think Albert's response was quite good and this issue is
more or less finshed, too. I will post another reply, to it on that
thread.

Rainer