RE: [Syslog-sec] Message ID in the header

["Anton Okmianski" <aokmians@cisco.com>]

I support adding a separate field for message ID. This would make it more
readily available for filtering (easier parsing) than if it were part of a
structured content.  I think it should be optional.  

Thanks,
Anton.

-----Original Message-----
From: syslog-sec-bounces@willers.employees.org
[mailto:syslog-sec-bounces@willers.employees.org] On Behalf Of Rainer
Gerhards
Sent: Wednesday, December 08, 2004 12:38 PM
To: syslog-sec@employees.org
Subject: [Syslog-sec] Message ID in the header

Hi list,

finalizing syslog-protocol, I realized that SENDER-NAME/-INST is actually
NOT really what TAG was. One usage of TAG was to provide the
SENDER-NAME/-INST information. But it also had an other use: It often served
as a message ID (something like "PIX-3333-3"). We do NOT (yet) have anything
like a message ID in the message header. At least for me, I was so focussed
on the new semantics that I overlooked the other common use for TAG.

So we have another issue: do we need to include a message ID in the header?
Should we drop it altogether? Or should we add an defined structured data
ID?

Comments are appreciated.

Rainer
_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec
_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec