Subject: RE: [Syslog-sec] cooked messages max size

From: "Rainer Gerhards" <[email-masked]>
Date: Fri, 20 May 2005 10:27:49 +0200

Robert,

a follow-up to my own message. I've searched the mail archive for past
discussions and found an interesting one that specifically mentions IHE
and RFC 3881. This discussion was the one that is at the core of the
message size specification in syslog-protocol, which we are currently
discussion. Please note that syslog-protocol will most probably
influence the next version of RFC 3195, so the length restrictions made
here will most likely apply to any further versions of 3195 (until
-protocol is revised itself).

The discussion starts around
http://www.syslog.cc/ietf/autoarc/msg01297.html

and mentions RFC3888 here
http://www.syslog.cc/ietf/autoarc/msg01299.html

I guess it is necessary to read the whole thread to fully understand it,
the two links provided above are most probably not sufficient.

At the bottom line, I think the concensus in the WG was that no current
implementation of syslog supports more than 1K messages. I am thinking
this because we discussed >1K message as something *totally new* to
syslog, not as something that is already being used.

*IF* it is in use, we eventually need to change the length restriction
in syslog-protcol, even though I do not like the idea at this stage.

Comments are deeply appreciated.

Rainer

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Robert Horn
> Sent: Thursday, May 19, 2005 9:10 PM
> To: Marshall Glen <glen.f.marshall
> Cc: [email-masked]
> Subject: RE: [Syslog-sec] cooked messages max size
> 
> 
> Also, a refinement of the RFC 3881can be found at:
> 
> ftp://medical.nema.org/medical/dicom/supps/sup95_fz.pdf
> 
> This takes the general framework of RFC 3881 and further specifies
> requirements for how particular events are to be encoded for medical
> devices.
> 
> One of the interesting things learned in the early work with 
> this is that
> describing events in XML consumes quite a few bytes.  Really 
> simple events
> fit under 1024 bytes, but it does not take much complexity to 
> push past
> that limit. A much more realistic limit to impose is a 64KB 
> limit.   The
> commonplace event that  "PACS archive sent study X about patient Y to
> workstation A to prestage it for physician Z based on current 
> appointment
> schedules" chews up a surprisingly large message if you include full
> details about the study, machines, and times.  Since these 
> messages are
> defined by multiple schema with namespaces (to manage 
> inheritance properly)
> fully qualified XML tags can become quite large all on their own.
> 
> The ability of the COOKED transport to indicate the schema is 
> also useful
> for the receiving servers so that they can route and parse much more
> effectively.
> 
> R Horn
> 
> _______________________________________________
> Syslog-sec mailing list
> [email-masked]
> http://www.employees.org/mailman/listinfo/syslog-sec
> 
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 20 May 2005 12:25:35 -0400

I didn't go back top read all those threads again. 

As I recall, we agreed that there should be a restriction to the
message size, but also permitted implementations to suppport the size
required for things like IHE. I don't remember whether we did this by
stating that compliant implementations would support the size
restriction, but implementations could always support larger sizes as
an implementation choice. I think it unreasonable to expect all
implementations to support the huge message sizes required by IHE, as
that could joepardize the usefulness of syslog for its original
purpose.

dbh

> [mailto:[email-masked]] On Behalf Of 
> Rainer Gerhards
> Sent: Friday, May 20, 2005 4:28 AM
> To: Robert Horn; Marshall Glen