> The only way to do that is to support untyped freeform log
> %-subs text. If you do that, what's the point of the whole
> exercise? May as well just have a function called "syslog()"
> that does all the syslog stuff except uses tagged
> date/timestamp and machine-ID and priority. In which case the
> end result of all this discussion is a syslog that is only a
> tiny bit less sucky than the current one, which everyone will
> use for everything. (Let's see, now we've come full-circle
> to the same discussion we had 2 weeks ago..)
>
> To make progress, you must slay the demon of backwards compatibility.
NOPE - I don't think so. Let's face it: we will have both traditional
("old style" ;)) syslog and messages from what we propose for a LONG
time inside our logs. I would appreciate at least to have a definite
indication of whether it is old or new style (see my previous post). As
such, I think a syslog(3) replacement that comes for fee to the app
developer is definitely worth something. Agree, it is not perfect, but
it is better than not to have it.
[snip]
> >Sounds good. One thing to keep in mind is to clearly identify "free
> >form" tags so we don't run into a situation where a revision
> of the tag
> >dictionary adds tags that are already in use by some application.
>
> I'd suggest that the "known tags" be prefixed with a
> prefix indicating that they are such. I.e: "EVT_DATE"
> or whatever. Then just establish the convention that nobody
> defines their own "EVT_*" tags.
Sounds good.
Rainer
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis
This archive was generated by hypermail 2b30 : Fri Jan 03 2003 - 09:18:44 PST