Re: [logs] Syslog payload format

From: Paul Robertson (probertsat_private)
Date: Fri Jan 03 2003 - 09:12:13 PST

  • Next message: Paul Robertson: "RE: [logs] Syslog payload format"

    On Fri, 3 Jan 2003, Marcus J. Ranum wrote:
    > >Sounds good. One thing to keep in mind is to clearly identify
    > >"free form" tags so we don't run into a situation where a revision
    > >of the tag dictionary adds tags that are already in use by some
    > >application.
    > I'd suggest that the "known tags" be prefixed with a
    > prefix indicating that they are such. I.e: "EVT_DATE"
    > or whatever. Then just establish the convention that nobody
    > defines their own "EVT_*" tags.
    Why not just have one reserved prefix, CMN_ or R__ that's reserved.  If 
    it was R_, then R_EVT_* would be resered, but EVT_FOO would be a free for 
    all.  A key is to avoid the whole vendor/application ID thing IMO, that's 
    where you start to get the ongoing baggage.
    Paul D. Robertson      "My statements in this message are personal opinions
    probertsat_private      which may have no basis whatsoever in fact."
    LogAnalysis mailing list

    This archive was generated by hypermail 2b30 : Fri Jan 03 2003 - 18:57:40 PST