Subject: RE: [Syslog] New direction and proposed charter

From: "Rainer Gerhards" <[email-masked]>
Date: Tue, 22 Nov 2005 18:24:54 +0100

> > WG,
> > <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID [SD-ID]s MSG
> 
> I would put the SD-IDs after the message.

This raises the question of what terminates the MSG part ;) That would
mean we would need to introduce byte-counting, at least I think so.
Other than that, I, too would find it better to place it at the end. On
the other hand, a -protocol compliant syslogd could take out SD-IDs and
put them after the message (or even discard them if the operator is not
interested --> configuration option [not a protocol issue]). At least
this was what I have on mind about how to implement it.

> 
> The SD-IDs and detailed bits of meaning to the MSG and without the
> MSG, are irrelevant.  The exception being a language marker.
> 
> > - replace NUL with an escape sequence upon reception (e.g. <00>)
> 
> Why not \0 ?

That's another good choice. My point was that most implementations would
do some modification on reception. That means a relay could actually
*alter* the message, which in turn would break signatures. If we require
relays to handle \0 correctly, that will probably cause a lot of trouble
to existing syslogd code. That was my main message. Is it better to live
with that or introduce a CLR on not allowing NUL?

Rainer

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Darren Reed <[email-masked]>
Date: Wed, 23 Nov 2005 16:06:26 +1100 (EST)

> This raises the question of what terminates the MSG part ;)

Using the above syntax, how do you distinguish between [] at the start
of the message from actualy SD-ID data?

I think what's missing from the above, is a ':' and the syntax should
be:

<PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID [SD-ID]: MSG

The protocol document needs to outlaw ':' being in any field before
the MSG.

If you mark "VERSION", "PROCID" and "SD-ID" data as all being optional
then the format comes back to being very close to what's in use today.

> That would

Well, without the ':' to say where the MSG starts, I'd have argued
"How do you tell where SD-ID ends and MSG starts?" vs there just being
a string of bad SD-ID data following some good SD-ID data.

As for "but the SD has important information and the MSD does not",
that's simply a matter of how you structure the message.

> That's another good choice.

It's also how data gets escaped, in general, in Internet stuff.

> That was my main message. Is it better to live

I'd like to see NUL outlawed from messages.

Darren