Subject: [Syslog] Legitimate \n or byte-counting

From: Chris Lonvick <[email-masked]>
Date: Fri, 18 Aug 2006 07:35:35 -0700 (PDT)

Hi,

If we use LF-escaping in syslog messages, what's going to happen if a 
legitimate "\n" is sent by a sender?  An example would be:

    <PRI>... BOM The offending characters are \n

Will a receiver convert that into LF?  If that's the case then we should 
not be using LF-escaping.

We need this answered today.

Thanks,
Chris

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Carson Gaspar <[email-masked]>
Date: Fri, 18 Aug 2006 13:18:51 -0700

> not be using LF-escaping.

I raised the same issue. The answer is the receiver will examine the 
protocol version and will not un-escape unless the sender is a new-style 
sender. I'm still not convinced that the installed base of TCP syslog 
deployments is large enough to care about, but, given the decision to 
maximize backwards comparability, this is "good enough" to make 
implementation possible.

-- 
Carson

---

From: "David Harrington" <[email-masked]>
Date: Fri, 18 Aug 2006 18:20:26 -0400

Hi,

[speaking as co-chair]

I believe it is inaccurate to say there has been a WG decision to
maximize backwards compatibility.

The charter says
"The goal of this working group is to address the security and
integrity
problems, and to standardize the syslog protocol, transport, and a 
select set of mechanisms in a manner that considers the ease of 
migration between and the co-existence of existing versions and the 
standard."

There is a big difference between "maximizing for backwards
compatibility" and "considering the ease of migration between and the
co-existence of existing versions and the standard." 

This difference was discussed during the charter discussions. We need
to balance backwards compatibility with improved interoperability and
good technical design.

We need to focus on **forward** compatibility - defining a standard
that implementors can move forward toward so there is increased
commonality, vendor neutrality, and interoperability.
 
If we keep trying for backwards compatibility to a wide range of
incompatible implementations, then we might as well go home now.

David Harrington
[email-masked] 
[email-masked]
[email-masked]
co-chair, Syslog WG 

> -----Original Message-----
> From: Carson Gaspar [mailto:[email-masked]] 
> Sent: Friday, August 18, 2006 4:19 PM
> To: [email-masked]
> Subject: Re: [Syslog] Legitimate \n or byte-counting
>

---

From: "Rainer Gerhards" <[email-masked]>
Date: Sat, 19 Aug 2006 05:20:06 +0200

David,

I have just now be able to poll my mail. I trust you as a co-chair that
this time the documents will not be torn apart because of the missing
backwards compatibility. Thus, I agree we should move to octet-couting,
as there is more consensus to use that (and it is technically superior).

I would just deeply appreciate if you could try to make sure this will
not be the reason for violent objection of the document set as it was
last year.

Thanks for driving this discussion and getting us to consensus.

Rainer 

> From: David Harrington [mailto:[email-masked]] 
> Sent: Friday, August 18, 2006 4:20 PM
> To: 'Carson Gaspar'; [email-masked]
> Subject: RE: [Syslog] Legitimate \n or byte-counting
> 
> Hi,
> 
> [speaking as co-chair]
>