RE: [logs] Syslog payload format

Previous message: Drew, Dale: "RE: [logs] Windows Event Log Analysis"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

rgerhardsat_private

> >   My suggestion: EOS means "broken message", so the 
> "messages MUST end 
> >   with (CR)LF" really means _must_.  This makes it easier 
> for receivers;
> >   if their socket layer is too hidden from view, it may be hard to 
> >   differentiate between "graceful FIN handshake" and "connection 
> > b0rken".
> 
> If something very bad is happening, it's possible that only 
> part of a message will get transmitted before the system dies 
> (e.g., power failure).  In that case it would be helpful to 
> store what you can of the message so that you have a record 
> of the crash.
> 
> I suggest that listeners MUST intepret EOS as CRLF while 
> senders SHOULD always terminate messages with CRLF, even if 
> they're about to close the connection.

I opt for this version. After all, even EOS can man we have an
(partially) interesting message. Maybe the collector shold add a
(defined) tag about it being malformed.

Rainer
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis