RE: [Syslog-sec] syslog message truncation

["Rainer Gerhards" <rgerhards@hq.adiscon.com>]

Sharon,

> If truncation is required, then the point of truncation be 
> determined. If it
> is within the message text, then the truncation bit be set within the
> message header and the message be sent with its reduced size. 
> If the point
> of truncation is somewhere before the message text, then this 
> message be
> discarded.

I am not sure if it is appropriate to drop the message completely. At
least the drop should be optional (maybe with a rule that the truncated
message should not further be forwarded).

I am concerned because I think we might loose vital information in this
case.

As an alternate approach, the "truncation information field" could have
three values:

n - no truncation occured
m - truncation im MSG part
s - truncation in STRUCTURED-DATA part

that would convey enough information to the (ultimate) receiver so that
it can decide how to act on a message.

Comments?

Rainer
_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec