[logs] RE: syslog/tcp (selp)

From: Rainer Gerhards (rgerhardsat_private)
Date: Thu Jan 09 2003 - 01:47:12 PST

  • Next message: Balazs Scheidler: "[logs] Re: syslog/tcp (selp)"

    > Attached you will find a patch to fix a couple of typos.
    
    I'll go over it soon, but I think I will keep silent today and look what
    other feedback comes in, so I can consolidate.
    
    > 
    > And the my NOTES:
    > * there's an RFC2223 which documents how to format documents
    > using roff
    >   macros, it makes it easier to maintain document structure 
    > and adds page
    >   numbering
    
    Ahhh... I actually used Jon Postel's nroff template. I guess it would
    have been clever to post the source, too ;) Anyhow, I am not sure if I
    review RFC2223 - I'll do so before the update.
    
    Ok, for those that might not have changed the file, here is the original
    nroff source:
    
        http://adiscon.org/specs/simple-event-log-protocol.txt
    
    > * the use of RFC3164 timestamp should not be forbidden (it is
    > easy to decide
    >   whether RFC3164 or RFC3339 timestamp is there)
    
    OK - I just (now) would like to put emphasis on the fact that the new
    stamp should be used. But I'll re-word.
    
    > * we should not discuss character sets, we should only state
    > that the MSG
    >   part is transmitted 8bit clean
    
    Agree. But this still prohibits DBCS, as byte values below 0x20 can
    occur, especially CRLF. This probably confuses collectors not expecting
    this. We could solve this with byte-counting, but I am not sure if we go
    overboard. After all, it should be a very slight addition to
    syslog/udp...
    
    Rainer
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Thu Jan 09 2003 - 12:20:25 PST