Darren Reed wrote:
>In some mail from Marcus J. Ranum, sie said:
>[...]
>> As far as future logs? You're kind of stuck unless
>> you replace syslogd - I don't know if any of the current popular
>> versions are smart enough to paste in the year-value if one is
>> not provided, but they should...
>
>...but doing so means they would not be format (bug) compatible!
Darren -
Being "backwards compatible" with "broken" means being "broken"
Has anyone on this list noticed that the discussion is distressingly
circular? * Every couple months the same topics come around and all the
same players weigh in and pretty much say the same things. I'm certainly
one of them. :) My "same old same old" is my "syslog must die" position
and my "XML doesn't help with the semantics of logging" position. :)
So this is the standard "syslog must die" rant. :)
Syslog got so many things wrong in so many ways that it's
basically not fixable without turning it into something that is no
longer syslog. They left the years out. They used unreliable transport
(OK, that can be band-aided...) There are no semantic standards on
the inputs, which means semantics must be entirely applied externally.
There are not even quoting standards within the messages of logs,
etc. etc. etc. If thoughtful people started a standards committee
chartered with coming up with something WORSE than syslog, they'd be
hard-pressed. But then there's BEEP...
Backwards compatible/bug compatible with syslog? Who wants
it? I just want logging that doesn't suck.
mjr.
(* I represented this by the circular ying-yang sawblade on the
loganalysis.org website logo...)
---
Marcus J. Ranum http://www.ranum.com
Computer and Communications Security mjrat_private
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis
This archive was generated by hypermail 2b30 : Fri Dec 27 2002 - 09:54:03 PST