RE: [Syslog-sec] Syslog protocol - version 12, sec 6.2.4 TRUNCATE value

["Rainer Gerhards" <rgerhards@hq.adiscon.com>]

I think this is a very reasonable and valuable suggestion. If nobody objects, I will add this to the draft.

Rainer

> -----Original Message-----
> From: syslog-sec-bounces@www.employees.org 
> [mankilto:syslog-sec-bounces@www.employees.org] On Behalf Of 
> Steve Chang (schang99)
> Sent: Monday, June 06, 2005 7:22 PM
> To: syslog-sec@employees.org
> Subject: [Syslog-sec] Syslog protocol - version 12, sec 6.2.4 
> TRUNCATE value
> 
> Hi,
>  
> These are the current assigned values for TRUNCATE:
> 
> 0 = no truncate
> 1 = all or some SD-ELEMENTS were truncated
> 2 = all or part of MSG was truncated        
> 4 = truncation occurred at the initial sender
>  
> I like to point out that the current reserved numbers do not 
> seem sufficient to cover a scenario which more than two of 
> the sender, interim systems and receiver have something to do 
> with the truncation on the message for some reason, like 
> temporary system memory shortage or slow application 
> performance caused backwater at the receiving port, etc.  
> 
> Therefore, I would like to propose:
> 
>  8 = truncation occurred at an interim system. 
> 16 = truncation occurred at receiver
> 
> So, in the case which the initial sender and interim system 
> and receiver all had to truncate some part of the MSG of a 
> syslog message, the TRUNCATE value will be equal to 2 + 4 + 8 
> + 16 = 30.  The will help avoid the guessing game.
> 
> Any thoughts?
>  
>  
> Thanks,
>  
> Steve Chang
>  
> _______________________________________________
> Syslog-sec mailing list
> Syslog-sec@www.employees.org
> http://www.employees.org/mailman/listinfo/syslog-sec
> 
_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec