RE: -protocol: transport mappings

[Rainer Gerhards <rgerhards@hq.adiscon.com>]

> 2.  I think requiring UDP implementation reduces the areas in which
> syslog message format RFC could be utilized.  I can see many different
> areas.  For example, if RFC came without UDP baggage, we,
> within Cisco,
> could potentially standardize on this format for products which write
> directly to log file (no syslog servers) should be compatible with the
> format.  This would be a great thing for us to be able to have a
> consistent format regardless of whether or not syslog
> transport is used
> because it is inevitable that some products will use syslog and other
> will write straight to file.
>
> Another use case I have is writing log messages into Windows
> Event Log.
> I would really like if that format be the same as on other platforms
> which use syslog.  It would have been easier for us to establish this
> requirement for products within Cisco if we could just refer to syslog
> message format RFC and it did not come with a baggage of having to
> implement a syslog UDP transport, which may not be applicable.
>
> So, I am open on whether or not UDP binding is included in
> -protocol or
> outside.  But I would really prefer if it was not required.

I agree on your general comments. In fact, that was one of the
motivations of splitting -protocol. I think, however, that even if we
specify a required transport mapping in -protocol itself, that does not
necessarily prohibt this.

I think you are talking about storage here. It seems natural that no
transport is needed to store the message. I think the implementation
requirement can be worded so that a minimal transport mapping needs only
to be implemented if the program actually uses a transport.

Besides that, I think you can always say that "the format must adhere to
RFCxxxx, section 4." - that should leave out any ambiguity.

I will comment on the other issue in a summary mail I am right now
preparing.

Rainer