Re: [logs] Syslog payload format

From: Mikael Olsson (mikael.olssonat_private)
Date: Fri Jan 03 2003 - 15:37:17 PST

  • Next message: Greg Black: "Re: [logs] Syslog payload format"

    Rainer Gerhards wrote:
    > 
    > > - Why not make the timestamp ISO?  The new transport obviously
    > >   requires new code, so ... ?
    > 
    > I simply still assume that we not to intend to spec a new protocol. So I
    > am thinking more or less in the boundaries of 3164. Keep in mind we need
    > to interoperate.
    
    Welpz. I've made my point. You disagree. I won't beat this 
    particular grass-eating quadraped any more.
    
    
    > > - And here's the big one: The (CR)LF needs to _terminate_ messages,
    > >   _not_ start new messages.  Why?  Well, consider a host that only
    > >   sends messages a few times a day, and also consider the fact that
    > >   I might want to do automatic alerting for a certain event.
    > >   Without termination, I would have to wait several hours for the
    > >   next event to arrive before I could act on the message.
    > >
    > >   Recognizing that EOF is termination of an event is hardly
    > >   rocket science. All fgets() implementations do this.
    > 
    > If we stay with 3164 (slightly enhanced for TCP), the message will never
    > be split across two packets. There is a 1024 char limit for this reason.
    > As such, when the end of the received packet is reached and there is no
    > LF, then *this* is the end of the message. No need to wait any more
    > hours. Of course, if you engineer a new protocol, I fully agree...
    
    Ah, but here's the problem: there are no "packets" in TCP.
    TCP is a stream.
    
    Sure, one single send() call usually results in one packet sent, but what
    about retransmits?  It is entirely legal for a TCP stack, when 
    retransmitting packets, to combine several small segments into
    one large segment.  Indeed, it is even desirable to do so to 
    lower the header to data ratio, and the Nagle delay algorithm
    accomplishes exactly this even when you aren't retransmitting.
    
    -- 
    Mikael Olsson, Clavister AB
    Storgatan 12, Box 393, SE-891 28 ÖRNSKÖLDSVIK, Sweden
    Phone: +46 (0)660 29 92 00   Mobile: +46 (0)70 26 222 05
    Fax: +46 (0)660 122 50       WWW: http://www.clavister.com
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Fri Jan 03 2003 - 18:47:31 PST