Re: [logs] Syslog payload format

betat_private

2002-12-17-14:49:50 Rainer Gerhards:
> Reading your mail, I looks like the recent syslog RFC's should
> never have hit the IETF - no running code an the like...

You've certainly read my intent right:-).

> I thought a lot about your post. To me, it sound a little bit like
> give up on the payload, there will never be a standard...

That wasn't my intent. Rather, tackle transport and timestamp now,
as they're [relatively] easy and non-contentious. Tackle payload by
getting a grip on semantics, then building a prototype
implementation to prove the semantic structure, then getting enough
experience with it in real application to ensure that it really does
work as hoped. Then try and get a standards-track RFC to document
the proven protocol.

> Wouldn't it be an option for at least some implementors to
> define something they can work with and do that? Is it really so
> hopeless?

Certainly it's an option, and if any implementors find it appealing,
there's nothing holding them back. It's _my_opinion_ that trying to
nail down the syntax to use is a pointless flamewar at this point;
that _if_ we get a sound definition of the actual classifications
and prioritizations and whatnot, that we really know work, then
there will be real motivation to make sure we're using sound syntax.
I think we need the taxonomy and the prototype implementation (let
the prototype implementor pick whatever syntax they find most
tasteful) before we have the real incentive to settle on a final
syntax.

> Regarding the taxonomy, I see your point. It is just that I think it
> should not be a closed set, but dynamically extensible.

Oh, we've got extensible now --- free-format strings. Nothing keeps
you from spitting wads of XML into today's syslog if that grooves
you:-). The problem with extensibibility is that it limits
automation.

That's about as far as my thoughts go, I've not yet gotten that
close to this problem, haven't looked over the existing taxonomies.
I agree, it seems reasonable to try and start with them.

-Bennett