Re: [logs] Syslog payload format

From: Karl Vogel (vogelkeat_private)
Date: Wed Dec 18 2002 - 08:58:05 PST

  • Next message: Marcus J. Ranum: "RE: [logs] Syslog payload format"

    >> On Wed, 18 Dec 2002 00:03:16 +0200, 
    >> marc <marcat_private> said:
    
    M> Maybe the description of the protocol I use for IDS/A might also be
    M> useful.  It is a label=value format.
    
    M> http://jade.cs.uct.ac.za/idsa/simple-readable-message-protocol.txt
    M> Simple Readable Message Protocol
    M> [ ... elided ... ]
    
    M> The escape syntax can be thought of as a compact version of the one used
    M> by Mark Nudelman's less and should thus be reasonably familiar.
    
       Instead of using backslashes or carets to handle special characters,
       you could use URL-style encoding with a percent sign followed by two
       hex characters.
    
       It's slightly simpler, and (even better) there's lots of C and Perl code
       around to handle encode/decode already.
    
    -- 
    Karl Vogel               ASC/YCOA, Wright-Patterson AFB, OH 45433
    vogelkeat_private                   http://www.dnaco.net/~vogelke
    
    Arms in the hands of citizens may be used at the individual's discretion,
    in private self-defense.
          --John Adams, A Defense of the Constitutions of Government of
            the United States of America, 1787-88
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Wed Dec 18 2002 - 21:49:01 PST