RE: [logs] RE: syslog/tcp (selp)

From: Rainer Gerhards (rgerhardsat_private)
Date: Wed Jan 15 2003 - 09:41:52 PST

  • Next message: Jason Royes: "Re: [logs] RE: syslog/tcp (selp)"

    > Could you describe the scenario in which the current selp.txt 
    > proposal is unreliable?
    OK, I promised to describe it in more detail today, so I am posting an
    interim version of the SELP spec at
    I have not yet been able to update it completely. In fact, it is more or
    less unedited, with the exception of section 2. For the evil in SELP,
    please read 2.4 and 2.5 at least. It has much of what can go wrong. Any
    comments and any more possible failure scenarios are highly appreciated.
    Please note that I have not yet run it through a spell checker. I will
    do so once I am thru with the complete edit. As such, there are for sure
    typos in it.
    I suggest to have a look at the interim spec only if you are interested
    in why SELP is not fully reliable. If you have a more general interest -
    or can wait a little - it might be easier to wait until the next
    polished version (which I am working on).
    Thanks for the understanding,
    Rainer Gerhards
    LogAnalysis mailing list

    This archive was generated by hypermail 2b30 : Wed Jan 15 2003 - 09:49:32 PST