Subject: [Syslog-sec] Syslog protocol - version 12, sec 6.2.4 TRUNCATE value

From: "Steve Chang (schang99)" <[email-masked]>
Date: Mon, 6 Jun 2005 10:22:04 -0700

Hi,
 
These are the current assigned values for TRUNCATE:

0 = no truncate
1 = all or some SD-ELEMENTS were truncated
2 = all or part of MSG was truncated        
4 = truncation occurred at the initial sender
 
I like to point out that the current reserved numbers do not seem sufficient to cover a scenario which more than two of the sender, interim systems and receiver have something to do with the truncation on the message for some reason, like temporary system memory shortage or slow application performance caused backwater at the receiving port, etc.  

Therefore, I would like to propose:

 8 = truncation occurred at an interim system. 
16 = truncation occurred at receiver

So, in the case which the initial sender and interim system and receiver all had to truncate some part of the MSG of a syslog message, the TRUNCATE value will be equal to 2 + 4 + 8 + 16 = 30.  The will help avoid the guessing game.

Any thoughts?

Thanks,
 
Steve Chang
 
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: "Rainer Gerhards" <[email-masked]>
Date: Mon, 6 Jun 2005 22:32:52 +0200

I think this is a very reasonable and valuable suggestion. If nobody objects, I will add this to the draft.

Rainer

> -----Original Message-----
> From: [email-masked] 
> [mankilto:[email-masked]] On Behalf Of 
> Steve Chang (schang99)
> Sent: Monday, June 06, 2005 7:22 PM
> To: [email-masked]
> Subject: [Syslog-sec] Syslog protocol - version 12, sec 6.2.4 
> TRUNCATE value
> 
> Hi,
>  
> I like to point out that the current reserved numbers do not 
> seem sufficient to cover a scenario which more than two of 
> the sender, interim systems and receiver have something to do 
> with the truncation on the message for some reason, like 
> temporary system memory shortage or slow application 
> performance caused backwater at the receiving port, etc.  
> 
> So, in the case which the initial sender and interim system 
> and receiver all had to truncate some part of the MSG of a 
> syslog message, the TRUNCATE value will be equal to 2 + 4 + 8 
> + 16 = 30.  The will help avoid the guessing game.
> 
> Any thoughts?
>  
>  
> Thanks,
>  
> Steve Chang
>