[Syslog-sec] Syslog protocol - version 12, sec 6.2.4 TRUNCATE value

["Steve Chang (schang99)" <schang99@cisco.com>]

Hi,
 
These are the current assigned values for TRUNCATE:

0 = no truncate
1 = all or some SD-ELEMENTS were truncated
2 = all or part of MSG was truncated        
4 = truncation occurred at the initial sender
 
I like to point out that the current reserved numbers do not seem sufficient to cover a scenario which more than two of the sender, interim systems and receiver have something to do with the truncation on the message for some reason, like temporary system memory shortage or slow application performance caused backwater at the receiving port, etc.  

Therefore, I would like to propose:

 8 = truncation occurred at an interim system. 
16 = truncation occurred at receiver

So, in the case which the initial sender and interim system and receiver all had to truncate some part of the MSG of a syslog message, the TRUNCATE value will be equal to 2 + 4 + 8 + 16 = 30.  The will help avoid the guessing game.

Any thoughts?
 
 
Thanks,
 
Steve Chang
 
_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec