Subject: [Syslog-sec] cooked messages max size

From: [email-masked]
Date: Mon, 16 May 2005 03:16:52 -0400

My question is based on RFC 3195 & 3164.
In those RFC, it is clearly specified that BSD & RAW messages can't be longer than 1024 characters. Otherwise, the syslog servers & relays ignore the end of the message. What about cooked messages?

The part of the cooked message which could get long is the CDATA of the entry element. In RFC 3195, we can read this:
  The character data for the element is the unstructured syslog event
  message being logged.  If the original device delivers the message
  for the first time via the COOKED profile, it may have any structure
  inside the CDATA.  However, for maximum compatibility, the device
  SHOULD format the CDATA of the message in accordance with Sections
  4.2.1 through 4.2.3 of [1].
[1] is RFC 3164.
First, sections 4.2.1 to 4.2.3 in RFC 3164 don't exist. I assume that RFC 3195 refers to sections 4.1.1 to 4.1.3 of RFC 3164. (Since many sites have copied RFC 3195, it will probably be difficult to catch up that error.)

The limit of BSD messages size is not defined in those sections. It is defined just before it, between the 4.1 title and the 4.1.1 title. The result is that, technicaly, no size limit seems to be defined for cooked messages.
I suppose that, for backward compatibility reasons, cooked messages have to be shorter than 1024 characters. Could anyone confirm this, please?

MC
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: Robert Horn <[email-masked]>
Date: Wed, 18 May 2005 10:42:36 -0400

There are applications that are placing arbitrarily large XML encoded
messages into the body of cooked messages.  In practice these routinely
exceed 1024 bytes but rarely exceed 64K bytes.  However, the XML schema
used is unconstrained in size and may generate larger messages in some
situations.

R Horn  Agfa Healthcare