Re: [logs] Syslog payload format

From: Darren Reed (avalonat_private)
Date: Thu Jan 02 2003 - 09:12:47 PST

  • Next message: Darren Reed: "Re: [logs] Syslog payload format"

    In some mail from Marcus J. Ranum, sie said:
    > 
    > Balazs Scheidler wrote:
    > >What do others think about whether typing of tags should be done or not?
    > 
    > I don't think we need to type tags. The whole idea of tagging
    > the data is to allow it to be implicity typed.
    
    I think you're answering a different question than he asked or he's
    asking two questions there, perhaps unbekownst to himself.
    
    In my mind, tag, its value and the value's type are all separate,
    only to the API.  If the output is going to be in strings, so be
    it, but why constrain the API that way ?  It's times like this
    when I think of C as being too primitive for this and if I could
    express it all in Java, it'd be better.  When you serialise an
    object in java you esentially turn it into an XML text string with
    no type informatin.  The Java object knows what type it is and how
    to convert itself to/from whatever it serialises out to.
    
    What I'm trying to say is I want the API to do the string conversion
    based on input I give it rather than me doing it myself, assuming
    that it wants to output string data.  I don't want that output to be
    contain anything describing the type, only the tag & value.  I'm trying
    to convince others this is the way to go but I'm not having much luck!
    
    > IN FACT, "type inference from tag name" is what XML does, right?
    
    I don't know about that.  Looking at the examples in the book I
    have, all of the values are just strings and the only special
    type is "#PCDATA".  Then again, this book is a couple of years
    old now...
    
    The DTD is about the structure of the document (nesting), not so
    much the format of the data itself.
    
    > This stuff is so
    > damn obvious it's not even funny. It's just logging, it's not
    > brain surgery.
    
    But the problem isn't "just logging".  It's what sort of data
    do we want, how do we want it, etc.  At least in brain surgery
    they know what they need to do (or I hope they do) to make it
    better for one person.  Trying to sit around and come up with
    something that's better for lots of people is going to be
    understandably more tedious.  There seem to be a few people
    here that consider themselves "stakeholders" and its important
    for people to understand what others think.  This takes time,
    even over beer.  We may have discovered a few things twice,
    but that's all part of the discussion about the pros and cons
    of doing anything in a particular way.  I at least think it is
    important to understand these things so it shouldn't be thought
    of as time wasted - so long as everyone keeps an open mind.
    
    People joke about how bad syslog is.  I'm sure something just as
    bad could be easily churned out from this group as something new
    and wonderful but I don't think anyone is keen to have that happen.
    Don't be so impatient Marcus, think about how long IPv6 took to
    reach us(!) or IPsec...please, be mindful of the "..." :-)
    
    Just relax, have a few more beers and sit back waiting for some
    more ducks to fly by to pop off ;)
    
    Darren
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Thu Jan 02 2003 - 18:51:33 PST