Subject: [Syslog-sec] cooked messages max size

From: [email-masked]
Date: Wed, 18 May 2005 12:12:56 -0400

I thank both of you (Chris Lonvick & Robert Horn) for those interesting answers. It's more clear now.

In fact, for the moment, if the server and the client are developped separately, the server developper is the one who decides how long the messages will be allowed to be and a client that produces messages longer than 1024 characters can only hope the server can handle this. I think I'll consider having critical informations at the begining on the message.

MC
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: Marshall Glen <[email-masked]>
Date: Wed, 18 May 2005 12:20:39 -0400

As a specific example of what Rob Horn mentioned, see RFC 3881.  This is
also incorporated in the work of multiple healthcare standards groups.
Cooked reliable syslog messages are the transport.

Glen Marshall

-------------------------------------------------------------------------------
This message and any included attachments are from Siemens Medical Solutions 
USA, Inc. and are intended only for the addressee(s).  
The information contained herein may include trade secrets or privileged or 
otherwise confidential information.  Unauthorized review, forwarding, printing, 
copying, distributing, or using such information is strictly prohibited and may 
be unlawful.  If you received this message in error, or have reason to believe 
you are not authorized to receive it, please promptly delete this message and 
notify the sender by e-mail with a copy to [email-masked] 

Thank you

---

From: Robert Horn <[email-masked]>
Date: Thu, 19 May 2005 15:10:08 -0400

Also, a refinement of the RFC 3881can be found at:

ftp://medical.nema.org/medical/dicom/supps/sup95_fz.pdf

This takes the general framework of RFC 3881 and further specifies
requirements for how particular events are to be encoded for medical
devices.

One of the interesting things learned in the early work with this is that
describing events in XML consumes quite a few bytes.  Really simple events
fit under 1024 bytes, but it does not take much complexity to push past
that limit. A much more realistic limit to impose is a 64KB limit.   The
commonplace event that  "PACS archive sent study X about patient Y to
workstation A to prestage it for physician Z based on current appointment
schedules" chews up a surprisingly large message if you include full
details about the study, machines, and times.  Since these messages are
defined by multiple schema with namespaces (to manage inheritance properly)
fully qualified XML tags can become quite large all on their own.

The ability of the COOKED transport to indicate the schema is also useful
for the receiving servers so that they can route and parse much more
effectively.

R Horn

---

From: "Rainer Gerhards" <[email-masked]>
Date: Fri, 20 May 2005 10:13:12 +0200

Hi Robert, 

I agree on the need to support more than 1024 characters. This has been
discussed in this WG in length. However, I do NOT think that
RFC3195/COOKED currently supports more than 1024 characters inside the
message.

I am also not aware of any implementation of RFC3195/COOKED that
supports this size. The only implementations of 3195 I know of are
listed at:

http://www.syslog.cc/ietf/rfcs/3195.html

I would appreciate if you could let me know other implementation of it,
especially if it supports messages > 1K.

Rainer

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Robert Horn
> Sent: Thursday, May 19, 2005 9:10 PM
> To: Marshall Glen <glen.f.marshall
> Cc: [email-masked]
> Subject: RE: [Syslog-sec] cooked messages max size
> 
>