Subject: RE: [Syslog] New direction and proposed charter

From: "Rainer Gerhards" <[email-masked]>
Date: Tue, 22 Nov 2005 18:28:46 +0100

Anton: 

> > > WG,
> > > <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID [SD-ID]s MSG
> > 
> > I would put the SD-IDs after the message.
> > 
> > The SD-IDs and detailed bits of meaning to the MSG and 
> > without the MSG, are irrelevant.  The exception being a 
> > language marker.
> 
> I would prefer SD-ID where it is in example.  I would also 
> re-iterate suggestion of having MSGID in the header, which a 
> number of people supported.  Those two combined are arguably 
> more important than the MSG part itself.  For example (in 
> abbreviated syntax:
> 
> host.domain.com MyApp proc1234 STARTED_UP [ip=1.1.1.1]: The 
> applications has started
> 
> I could live without the MSG here if it got truncated. The 
> MSGID and SD-ID are much more important in this case.  BTW, 
> the possible truncation of text and its variability (possible 
> substitutable variables) is another reason why MSGID is so 
> useful. It makes it easier for intelligent receivers to do 
> things like event correlation. 

I, too, would like to see the MSGID in the header, just as this

<PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ID]s MSG

The issue is that we come closer and closer to the current
syslog-protocol-15 header with just the <PRI>. While this would be a
workable (and probably good) solution in my point of view, I have heared
some voices that would like to see fewer fields. I just caution to pull
out APP-NAME and PROCID and leave MSGID, because I would bet more than
one virtual can of beer that implementors will say "ah, MSGID is what
was called TAG" - and use it in that spirit. That would give us the
worst of both worlds...

Rainer
> 
> Thanks,
> Anton. 
> 
> > 
> > > - replace NUL with an escape sequence upon reception (e.g. <00>)
> > 
> > Why not \0 ?
> > 
> > Darren
> > 
> > _______________________________________________
> > Syslog mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/syslog
> > 
> 

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "Andrew Ross" <[email-masked]>
Date: Wed, 23 Nov 2005 16:20:35 +1300

WG,

Sorry for joining in the discussion late. I've only just found some time to
reply.

My thoughts below...

The new format looks great.

Replace all received null characters with either <00> or /0. My preference
is <00>.

Keep MSGID in the header as a required field

SD-IDs should come before the MSG. Otherwise encoding issues and MSG
delimiter will become a problem.

Store all messages written to disk in UTF-8 format. This allows any received
encoding to be stored safely without loss or corruption.

My preference is to enforce UTF-8 for data encoding on the wire. This allows
US-ASCII to be used for the first 127 characters and Unicode mappings into
UTF-8 for all other international characters. Trying to switch encodings for
each message based on the SD-ID language or local setting will be a parsing
nightmare. As far as I know, all modern systems are now capable of sending
in US-ASCII or mapping their own language into UTF-8. Can anyone think of a
good reason not to enforce UTF-8?

I believe the above format would be easy to implement in both a sender and
receiver. Mandating that the disk storage format is UTF-8 would also help
reporting and parsing of all languages and character sets. 

Mapping over UDP should be limited to a single message per packet.

When mapping over plain TCP I believe we should limit the total message size
to 65507 bytes (to keep it compatible with UDP) and delimit each message
stream with an LF, or CRLF. Either delimiter would work for me.

Rainer, keep up your good work and persistence on the drafts. I believe the
new format will solve a lot of problems.

Cheers

Andrew

---

From: "David B Harrington" <[email-masked]>
Date: Tue, 22 Nov 2005 23:30:11 -0500

Hi,

The IETF focuses on on-the-wire formats; we don't typically mandate
how one stores data after it is received. 

David Harrington
[email-masked]

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Andrew Ross
> Sent: Tuesday, November 22, 2005 10:21 PM
> To: 'Rainer Gerhards'; 'Anton Okmianski (aokmians)'; 'Darren Reed'
> Cc: [email-masked]
> Subject: [Syslog] Message format
> 
> 
> WG,
>