RE: -protocol: transport mappings

[Rainer Gerhards <rgerhards@hq.adiscon.com>]

Hi all,

thanks for all the great comments. Let me try to sum up the current
concensus:

- multiple transport mappings are a good thing
- it is at least helpful to have one required transport. Some do not
  really like this idea, but would tolerate it (correct me if I got
  this wrong!)
- a required transport should be the simplest one to implement.
  For syslog, UDP (more or less as in RFC 3164) qualfies for this.

Given that state of the discussion, I propose that we actually require
each implementation that talks to a transport MUST support the
to-be-written UDP transport mapping.

While UDP has many inherant issues, it can at least serve as an
easy-to-implement least common denominator if everything else fails. It
can't be so totally bad as a vast amount of syslog currently runs over
UDP. In fact, standards-compliant TCP syslog is rarely seen in today's
reality.

Now comes the issue if the UDP mapping should be a separate document or
included in -protocol. There are good arguments for both.

If we include the UDP transport mapping in -protocol, we gain:

- a single, self-contained document that describes *all* essentials
- this probably saves us some/much hassle during the IETF process

If we include UDP transport mapping in a separate document, we gain:

- a crystal-clear separation of the protocol layers
- focussed security considerations, which can relief from
  ambiguity
- the ability to develop the transport mapping and the
  core format independently

Actually, it's a hard decision. I don't know which way offers more
advantages. From my software engineering point of view, I am still in
favour of a separate document for the UDP mapping. But it may not be
worth the extra effort. Specifically, I am totally inexperienced what
this additional hassle in the IETF process is and how costly (in terms
of time) it will be.

I would appreciate if those experienced with these issues could let me
know their qualified votes. I would also like to know if someone
violently objects either one of the two approaches.

I am trying to settle this issue by Tuesday morning, just so that we
have a chance to move forward in regard of our deadline. I would deeply
appreciate any comments.

If I don't receive strong votes, I will probably edit the document based
on the concensus I have summarized AND will assume that the UDP
transport mapping will be done in a separate document.

Rainer