Re: [logs] RE: syslog/tcp (selp)

From: Mikael Olsson (mikael.olssonat_private)
Date: Fri Jan 10 2003 - 01:17:08 PST

  • Next message: Andrew Ross: "RE: [logs] RE: syslog/tcp (selp)"

    Andrew Ross wrote:
    > 
    > The more I think about it, the idea of binary data and non ASCII chr
    > sets should be left for the BEEP or syslog reliable implementations. 
    
    Amen :)
    
    > On the topic of delimiters. We discovered today that the PIX actually
    > sends a single LF at the end of its messages.
    
    Great!
    That just leaves the time stamp incompatible with the ideas we're
    discussing. 
    
    
    > We have been discussing the delimiter recently as being CRLF. Can I
    > throw the cat amongst the pigeons and suggest we make it just LF? LF is
    > the Unix standard delimiter for files and streams. CRLF is more of a
    > Windows convention.
    > 
    > Would it not be easier (and more code efficient) to search for just LF?
    > 
    > Someone mentioned that CRLF is the Internet standard, can someone point
    > me to a URL that defines this? I always thought the Internet was more
    > Unix driven than Windows.
    
    HTTP, FTP, POP3, SMTP, etc are all specified to use CRLF.
    However, most (albeit not quite all) daemons will also accept LF.
    
    The current talk was:
    - Senders SHOULD send CRLF
    - Receivers MUST be prepare to accept CRLF as well as LF.
    
    Coding this really isn't very hard, and would leave PIX compatible
    as far as (CR)LF termination is concerned.
    
    -- 
    Mikael Olsson, Clavister AB
    Storgatan 12, Box 393, SE-891 28 ÖRNSKÖLDSVIK, Sweden
    Phone: +46 (0)660 29 92 00   Mobile: +46 (0)70 26 222 05
    Fax: +46 (0)660 122 50       WWW: http://www.clavister.com
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Fri Jan 10 2003 - 10:17:41 PST