RE: [logs] Syslog payload format

From: Rainer Gerhards (rgerhardsat_private)
Date: Fri Jan 03 2003 - 08:17:18 PST

  • Next message: Karl Vogel: "Re: [logs] Syslog payload format"

    > The only way to do that is to support untyped freeform log 
    > %-subs text. If you do that, what's the point of the whole 
    > exercise? May as well just have a function called "syslog()" 
    > that does all the syslog stuff except uses tagged 
    > date/timestamp and machine-ID and priority. In which case the 
    > end result of all this discussion is a syslog that is only a 
    > tiny bit less sucky than the current one, which everyone will 
    > use for everything.  (Let's see, now we've come full-circle 
    > to the same discussion we had 2 weeks ago..)
    > To make progress, you must slay the demon of backwards compatibility.
    NOPE - I don't think so. Let's face it: we will have both traditional
    ("old style" ;)) syslog and messages from what we propose for a LONG
    time inside our logs. I would appreciate at least to have a definite
    indication of whether it is old or new style (see my previous post). As
    such, I think a syslog(3) replacement that comes for fee to the app
    developer is definitely worth something. Agree, it is not perfect, but
    it is better than not to have it.
    > >Sounds good. One thing to keep in mind is to clearly identify "free 
    > >form" tags so we don't run into a situation where a revision 
    > of the tag 
    > >dictionary adds tags that are already in use by some application.
    > I'd suggest that the "known tags" be prefixed with a
    > prefix indicating that they are such. I.e: "EVT_DATE"
    > or whatever. Then just establish the convention that nobody 
    > defines their own "EVT_*" tags.
    Sounds good.
    LogAnalysis mailing list

    This archive was generated by hypermail 2b30 : Fri Jan 03 2003 - 09:18:44 PST