Re: [logs] RE: syslog/tcp (selp)

From: Darren Reed (avalonat_private)
Date: Fri Jan 10 2003 - 17:52:05 PST

  • Next message: Darren Reed: "[logs] Rant on version numbers (was: Re: EventLog library)"

    A quick comment on simple-event-log-protocol.txt - what happened
    to section 3 ?
    
    It appears to go "2. Transport Layer Protocol" then "4.1 SELP
    Message parts", which seems somewhat odd.
    
    The document doesn't clearly express what the combined end result of all
    the fields is meant to look like as output.  While the timestamp does come
    after the PRI field, what about the HOSTNAME field ?
    
    In some mail from Mikael Olsson, sie said:
    > 
    > 
    > Andrew Ross wrote:
    > > 
    > > Sounds good to me.
    > > 
    > > Are you going to put the hostname AND host address as required fields?
    > 
    > Wouldn't that break things needlessly?  
    
    How would it needlessly break things ?
    
    We're already defining a new mesage so why be concerned about another
    change ?
    
    Darren
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Fri Jan 10 2003 - 20:04:31 PST