[Syslog-sec] syslog-protocol

["Rainer Gerhards" <rgerhards@hq.adiscon.com>]

Hi list,

I am more or less finished with my next edit (which hopefully brings us
very close to a final version). However there is one thing that I would
one again like to bring to the attention of the list - simply because it
is much that needs to be changed:

Anton suggested:
> I know you wanted to keep some resemblance of the old ad-hoc syslog
> format, but two separate fields for TAG would make life much easier
> then having to find the last [ and only if there is ] at the end.  If
> we make two fields, they would be APP-NAME (or PROCESS-NAME) and
> PROCESS-ID.  This is much more intuitive then describing it as static
> vs. dynamic. And this is what people are after in the end. We could
> allow for say "-" for unknown process ID. But I think requiring
> APP-NAME is a must. What do you think?

I responded:
>That sounds good - I actually did not have this good idea. If there is
>no objection, I'll change it to this in the next draft.

I am still of the opinion that this is a good idea - especially as it
also solves some parsing nightmare with the colon characters. It just
finally breaks the legacy TAG ... but that would be easily to re-create
in change a process needs to relay to a RFC 3164 collector.

So I, too, would opt for 2 "TAG" fields separated by SP. I'm not sure if
the above names would be the most appropriate, maybe TAG-NAME and
TAG-PID would be better to tie them back to the 3164 TAG.

I'd appreciate feedback on this issue. I definitely plan to submit the
next draft before the cutoff date at the end of this week.

Rainer
	
_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec