RE: [logs] Syslog payload format

From: Rainer Gerhards (rgerhardsat_private)
Date: Wed Jan 08 2003 - 00:25:15 PST

  • Next message: Mikael Olsson: "Re: [logs] Charset selection (Was: Re: EventLog library)"

    > >   My suggestion: EOS means "broken message", so the 
    > "messages MUST end 
    > >   with (CR)LF" really means _must_.  This makes it easier 
    > for receivers;
    > >   if their socket layer is too hidden from view, it may be hard to 
    > >   differentiate between "graceful FIN handshake" and "connection 
    > > b0rken".
    > If something very bad is happening, it's possible that only 
    > part of a message will get transmitted before the system dies 
    > (e.g., power failure).  In that case it would be helpful to 
    > store what you can of the message so that you have a record 
    > of the crash.
    > I suggest that listeners MUST intepret EOS as CRLF while 
    > senders SHOULD always terminate messages with CRLF, even if 
    > they're about to close the connection.
    I opt for this version. After all, even EOS can man we have an
    (partially) interesting message. Maybe the collector shold add a
    (defined) tag about it being malformed.
    LogAnalysis mailing list

    This archive was generated by hypermail 2b30 : Wed Jan 08 2003 - 08:15:55 PST