[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [Syslog-sec] Message ID in the header

I'll second that. Anything that makes parsing the messages easier to
achieve is good.

Andrew


-----Original Message-----
From: syslog-sec-bounces@www.employees.org
[mailto:syslog-sec-bounces@www.employees.org] On Behalf Of Anton
Okmianski
Sent: Thursday, 9 December 2004 8:07 a.m.
To: 'Rainer Gerhards'; syslog-sec@employees.org
Subject: RE: [Syslog-sec] Message ID in the header


I support adding a separate field for message ID. This would make it
more
readily available for filtering (easier parsing) than if it were part of
a
structured content.  I think it should be optional.  

Thanks,
Anton.

-----Original Message-----
From: syslog-sec-bounces@willers.employees.org
[mailto:syslog-sec-bounces@willers.employees.org] On Behalf Of Rainer
Gerhards
Sent: Wednesday, December 08, 2004 12:38 PM
To: syslog-sec@employees.org
Subject: [Syslog-sec] Message ID in the header

Hi list,

finalizing syslog-protocol, I realized that SENDER-NAME/-INST is
actually
NOT really what TAG was. One usage of TAG was to provide the
SENDER-NAME/-INST information. But it also had an other use: It often
served
as a message ID (something like "PIX-3333-3"). We do NOT (yet) have
anything
like a message ID in the message header. At least for me, I was so
focussed
on the new semantics that I overlooked the other common use for TAG.

So we have another issue: do we need to include a message ID in the
header?
Should we drop it altogether? Or should we add an defined structured
data
ID?

Comments are appreciated.

Rainer
_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec
_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec

_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec