RE: [Syslog-sec] MSGID Versus Facility versus Category

["Rainer Gerhards" <rgerhards@hq.adiscon.com>]

Sharon,

I overlooked this message. In syslog-protocol, there is no field
"category". The facility is a category, or as you call it very well an
"administratively assigned bucket". the MSGID is the smalles grouping in
the way that it can identify the type of message. Let me use a real
world sample to clarify.

If you look at Cisco's PIX message reference:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_me
ssage_guide_chapter09186a00801582b2.html#wp1054165

the "PIX-6-302014" (or just 302014) would make up a message ID. Same for
302015, 302016 and so on.

If you have any better wording for the description of MSGID, I would
appreciate if you could suggest it.

Rainer 

> -----Original Message-----
> From: syslog-sec-bounces@www.employees.org 
> [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of 
> Sharon Chisholm
> Sent: Wednesday, March 23, 2005 9:26 PM
> To: syslog-sec@employees.org
> Subject: [Syslog-sec] MSGID Versus Facility versus Category
> 
> hi
> 
> Ok. Is this the difference then for the three fields:
> 
> Facility: Administratively assigned bucket
> 
> Category: Fixed bucket
> 
> Message ID: The very smallest grouping of things without getting into
> instance-specific information?
> 
> Sharon
> --------------------
> <Rainer>
> > 
> > <Rainer>
> > > S1. In section 6, what is the relationship between Facility
> > > and MSG-ID? They
> > > seem to serve the same purpose. Is Facility just historical? 
> > > Is MSG-ID what
> > > we need to use moving forward? (see G3)
> > 
> > I added this text to the description of FACILITY:
> > 
> > ####
> > It is RECOMMENDED that the facility
> > reflects a type of subsystem, something that a number of 
> > different messages
> > might be issued from. So it is a kind of corase group. ####
> > 
> > Does this clarify? Do we need to add similar text to MSGID 
> (in that it
> > identifies a specific message)? To keep it short, I've not 
> > done this yet.
> > 
> > </Rainer>
> > 
> 
> <Sharon>
> > Now I'm left wondering how this relates to a category. 
> 
> </Sharon>
> 
> Yes, you are right. It is a category. But it is not a fixed one, the
> administrator can assign it.
> 
> </Rainer>
> 
> Sharon Chisholm
> Nortel 
> Ottawa, Ontario
> Canada
> _______________________________________________
> Syslog-sec mailing list
> Syslog-sec@www.employees.org
> http://www.employees.org/mailman/listinfo/syslog-sec
> 
_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec