RE: [Syslog-sec] cooked messages max size

["David B Harrington" <ietfdbh@comcast.net>]

I didn't go back top read all those threads again. 

As I recall, we agreed that there should be a restriction to the
message size, but also permitted implementations to suppport the size
required for things like IHE. I don't remember whether we did this by
stating that compliant implementations would support the size
restriction, but implementations could always support larger sizes as
an implementation choice. I think it unreasonable to expect all
implementations to support the huge message sizes required by IHE, as
that could joepardize the usefulness of syslog for its original
purpose.

dbh

> -----Original Message-----
> From: syslog-sec-bounces@www.employees.org 
> [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of 
> Rainer Gerhards
> Sent: Friday, May 20, 2005 4:28 AM
> To: Robert Horn; Marshall Glen
> Cc: syslog-sec@willers.employees.org
> Subject: RE: [Syslog-sec] cooked messages max size
> 
> Robert,
> 
> a follow-up to my own message. I've searched the mail archive for
past
> discussions and found an interesting one that specifically 
> mentions IHE
> and RFC 3881. This discussion was the one that is at the core of the
> message size specification in syslog-protocol, which we are
currently
> discussion. Please note that syslog-protocol will most probably
> influence the next version of RFC 3195, so the length 
> restrictions made
> here will most likely apply to any further versions of 3195 (until
> -protocol is revised itself).
> 
> The discussion starts around
> http://www.syslog.cc/ietf/autoarc/msg01297.html
> 
> and mentions RFC3888 here
> http://www.syslog.cc/ietf/autoarc/msg01299.html
> 
> I guess it is necessary to read the whole thread to fully 
> understand it,
> the two links provided above are most probably not sufficient.
> 
> At the bottom line, I think the concensus in the WG was that 
> no current
> implementation of syslog supports more than 1K messages. I am
thinking
> this because we discussed >1K message as something *totally new* to
> syslog, not as something that is already being used.
> 
> *IF* it is in use, we eventually need to change the length
restriction
> in syslog-protcol, even though I do not like the idea at this stage.
> 
> Comments are deeply appreciated.
> 
> Rainer
> 
> > -----Original Message-----
> > From: syslog-sec-bounces@www.employees.org 
> > [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of 
> Robert Horn
> > Sent: Thursday, May 19, 2005 9:10 PM
> > To: Marshall Glen <glen.f.marshall
> > Cc: syslog-sec@willers.employees.org
> > Subject: RE: [Syslog-sec] cooked messages max size
> > 
> > 
> > Also, a refinement of the RFC 3881can be found at:
> > 
> > ftp://medical.nema.org/medical/dicom/supps/sup95_fz.pdf
> > 
> > This takes the general framework of RFC 3881 and further specifies
> > requirements for how particular events are to be encoded for
medical
> > devices.
> > 
> > One of the interesting things learned in the early work with 
> > this is that
> > describing events in XML consumes quite a few bytes.  Really 
> > simple events
> > fit under 1024 bytes, but it does not take much complexity to 
> > push past
> > that limit. A much more realistic limit to impose is a 64KB 
> > limit.   The
> > commonplace event that  "PACS archive sent study X about 
> patient Y to
> > workstation A to prestage it for physician Z based on current 
> > appointment
> > schedules" chews up a surprisingly large message if you include
full
> > details about the study, machines, and times.  Since these 
> > messages are
> > defined by multiple schema with namespaces (to manage 
> > inheritance properly)
> > fully qualified XML tags can become quite large all on their own.
> > 
> > The ability of the COOKED transport to indicate the schema is 
> > also useful
> > for the receiving servers so that they can route and parse much
more
> > effectively.
> > 
> > R Horn
> > 
> > _______________________________________________
> > Syslog-sec mailing list
> > Syslog-sec@www.employees.org
> > http://www.employees.org/mailman/listinfo/syslog-sec
> > 
> _______________________________________________
> Syslog-sec mailing list
> Syslog-sec@www.employees.org
> http://www.employees.org/mailman/listinfo/syslog-sec
> 


_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec