Subject: RE: [Syslog] plain tcp syslog

From: Marshall Glen <[email-masked]>
Date: Mon, 17 Oct 2005 23:31:44 -0400

I'd like to see that too, although I think the length needs to be 32K for
healthcare audit records (see RFC 3881).

Glen Marshall 

-----Original Message-----
From: Andrew Ross [mailto:[email-masked]] 
Sent: Monday, October 17, 2005 18:03
To: 'Rainer Gerhards'; [email-masked]
Subject: RE: [Syslog] plain tcp syslog

Hi Rainer,

A document describing syslog over TCP would be very handy. Two things that
need to be identified are: the delimiting character - usually a LF (ASCII
&H0A) and how long the maximum message length should be (4096 chrs seems to
cover most implementations I've seen in the wild).

NetScreen firewalls can also send syslog via TCP.

Regards

Andrew

Kiwi Enterprises

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Rainer Gerhards
Sent: Tuesday, 18 October 2005 1:49 a.m.
To: [email-masked]
Subject: [Syslog] plain tcp syslog

Hi WG,

Chris has put some questions about RFC 3195 usage on the agenda for the next
IETF. In preparation for this, I am going to ask a question that I know is
very unpopular in the WG.

We have discussed the issue of a very-simple, non-BEEP based plain tcp
syslog several times on this list. The idea always has violently been
rejected.

However, the current status is that RFC 3195 is nicely standardized but
seldomly implemented and even less often deployed. Plain tcp syslog, on the
other hand, is not standardized but widely deployed. It is implemented at
least in:

- syslog-ng
- rsyslog
- Kiwi syslog daemon
- WinSyslog/MonitorWare Agent/EventReporter
- Cisco PIX

As of my experience, many syslog-ng installations use plain tcp syslog.
All of the implementations listed are interoperable. The list is most
probably not complete, these were just the products that came immediately to
my mind. The end user-base is also continously asking about such a simple
transport - this is probably why it is implemented so often.

Given the obvious importance of this protocol, wouldn't it make sense to at
least document its observed behaviour, much as RFC 3164 documents UDP based
syslog observed behaviour? Such a document could also be useful to document
the security and (un)reliability issues coming along with the "plain tcp"
syslog. Eventually, this could even increase demand for more reliable
solutions like RFC 3195.

Feedback is appreciated.
Rainer Gerhards

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

-------------------------------------------------------------------------------
This message and any included attachments are from Siemens Medical Solutions 
USA, Inc. and are intended only for the addressee(s).  
The information contained herein may include trade secrets or privileged or 
otherwise confidential information.  Unauthorized review, forwarding, printing, 
copying, distributing, or using such information is strictly prohibited and may 
be unlawful.  If you received this message in error, or have reason to believe 
you are not authorized to receive it, please promptly delete this message and 
notify the sender by e-mail with a copy to [email-masked] 

Thank you

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Balazs Scheidler <[email-masked]>
Date: Tue, 18 Oct 2005 13:50:04 +0200

> healthcare audit records (see RFC 3881).

I think a required limit and a SHOULD clause stating that
implementations should support longer message lengths via some
configuration mechanism would be ok. (for the record syslog-ng supports
specifying the maximum message length using a configuration parameter,
and it defaults to 8k)

-- 
Bazsi

---

From: Darren Reed <[email-masked]>
Date: Wed, 19 Oct 2005 00:22:31 +1000 (EST)

> healthcare audit records (see RFC 3881).

Why ?

RFC 3881 doesn't specify that syslog needs to be anywhere.

If you've got long records that need to be saved for audit purposes
then perhaps a protocol other than syslog should be used for this ?

Just because you have a hammer doesn't make everything you want to
fix a nail. (or however it goes :)

Darren