RE: [logs] Syslog payload format

Previous message: Andrew Ross: "RE: [logs] Syslog payload format"
In reply to: Bennett Todd: "Re: [logs] Syslog payload format"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

andrewat_private

>It would be nice if we could agree on one thing. I'm having trouble
>seeing the motivation for retaining the [deficient, partial]
>timestamp of classic syslog in the name of "interop", when we're
>defining a protocol which is profoundly not interoperable with it
>(TCP -vs- UDP). Rather than wasting space on a useless timestamp
>then putting the useful one in the "payload", let's just put a
>useful timestamp on the front of the messages.

You have my vote on that one. Since we are going to have to create new
code to send/receive via TCP, why not do it properly from the start?

Cheers

Andrew

_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis