Re: [logs] Syslog payload format

avalonat_private

In some mail from Marcus J. Ranum, sie said:
> 
> Balazs Scheidler wrote:
> >What do others think about whether typing of tags should be done or not?
> 
> I don't think we need to type tags. The whole idea of tagging
> the data is to allow it to be implicity typed.

I think you're answering a different question than he asked or he's
asking two questions there, perhaps unbekownst to himself.

In my mind, tag, its value and the value's type are all separate,
only to the API.  If the output is going to be in strings, so be
it, but why constrain the API that way ?  It's times like this
when I think of C as being too primitive for this and if I could
express it all in Java, it'd be better.  When you serialise an
object in java you esentially turn it into an XML text string with
no type informatin.  The Java object knows what type it is and how
to convert itself to/from whatever it serialises out to.

What I'm trying to say is I want the API to do the string conversion
based on input I give it rather than me doing it myself, assuming
that it wants to output string data.  I don't want that output to be
contain anything describing the type, only the tag & value.  I'm trying
to convince others this is the way to go but I'm not having much luck!

> IN FACT, "type inference from tag name" is what XML does, right?

I don't know about that.  Looking at the examples in the book I
have, all of the values are just strings and the only special
type is "#PCDATA".  Then again, this book is a couple of years
old now...

The DTD is about the structure of the document (nesting), not so
much the format of the data itself.

> This stuff is so
> damn obvious it's not even funny. It's just logging, it's not
> brain surgery.

But the problem isn't "just logging".  It's what sort of data
do we want, how do we want it, etc.  At least in brain surgery
they know what they need to do (or I hope they do) to make it
better for one person.  Trying to sit around and come up with
something that's better for lots of people is going to be
understandably more tedious.  There seem to be a few people
here that consider themselves "stakeholders" and its important
for people to understand what others think.  This takes time,
even over beer.  We may have discovered a few things twice,
but that's all part of the discussion about the pros and cons
of doing anything in a particular way.  I at least think it is
important to understand these things so it shouldn't be thought
of as time wasted - so long as everyone keeps an open mind.

People joke about how bad syslog is.  I'm sure something just as
bad could be easily churned out from this group as something new
and wonderful but I don't think anyone is keen to have that happen.
Don't be so impatient Marcus, think about how long IPv6 took to
reach us(!) or IPsec...please, be mindful of the "..." :-)

Just relax, have a few more beers and sit back waiting for some
more ducks to fly by to pop off ;)

Darren
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis