RE: [logs] RE: syslog/tcp (selp)

Previous message: Tina Bird: "Re: FW: [logs] Logging in the real world"
Maybe in reply to: Rainer Gerhards: "[logs] RE: syslog/tcp (selp)"
Next in thread: Rainer Gerhards: "RE: [logs] RE: syslog/tcp (selp)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

rgerhardsat_private

> Could you describe the scenario in which the current selp.txt 
> proposal is unreliable?

OK, I promised to describe it in more detail today, so I am posting an
interim version of the SELP spec at

    http://adiscon.org/specs/selp-2003-01-15.txt

I have not yet been able to update it completely. In fact, it is more or
less unedited, with the exception of section 2. For the evil in SELP,
please read 2.4 and 2.5 at least. It has much of what can go wrong. Any
comments and any more possible failure scenarios are highly appreciated.
Please note that I have not yet run it through a spell checker. I will
do so once I am thru with the complete edit. As such, there are for sure
typos in it.

I suggest to have a look at the interim spec only if you are interested
in why SELP is not fully reliable. If you have a more general interest -
or can wait a little - it might be easier to wait until the next
polished version (which I am working on).

Thanks for the understanding,
Rainer Gerhards
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis