RE: [logs] RE: syslog/tcp (selp)

Previous message: Rainer Gerhards: "RE: [logs] RE: syslog/tcp (selp)"
Maybe in reply to: Rainer Gerhards: "[logs] RE: syslog/tcp (selp)"
Next in thread: Bennett Todd: "Re: [logs] RE: syslog/tcp (selp)"
Reply: Bennett Todd: "Re: [logs] RE: syslog/tcp (selp)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

rgerhardsat_private

> > On the topic of delimiters. We discovered today that the 
> PIX actually 
> > sends a single LF at the end of its messages.
> 
> Great!
> That just leaves the time stamp incompatible with the ideas 
> we're discussing. 

Do you mean the PIX timestamp? If so, I would like to include some
wording that the receiver should try to parse common time stamp formats,
if it is not a RFC3339 timestamp. I know this is the opposite of what
RFC3164 specifies, and I know there are some issue with it - but I know
it because we all try it anyhow ;)

Rainer
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis