[Syslog-sec] Truncate field and sender

[Didier DALMASSO <dalmassd@echo.unice.fr>]

Hi,

Maybe this topic is a bit out of scope of the working group, but as an
implementor I'm wordering one thing about truncation.

Syslog-protocol defines use of the truncate field for relays and
collectors but says nothing about senders. In POSIX world, an userland
developer call syslog(int priority, const char *msg); libc write a
RFC 3164 message into /dev/log and then the syslog deamon catch it.

What the syslog daemon is supposed to do when a locally received message need to
be truncated. I see two possibility:

1/ Truncate field is only used to indicate truncations occurring during
transport. The sender always put 0 a truncate value

2/ Truncate field is also used to indicate truncation by sender

I'm thinking the second one is a better choice but I'm interested to know
your opinion.

Thanks
-- 
          Didier Dalmasso
_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec