Subject: RE: [Syslog] RE: Message format

From: "Moehrke, John \(GE Healthcare\)" <[email-masked]>
Date: Wed, 23 Nov 2005 10:49:34 -0600

Yes, at this point I am happy putting my serialized XML into the MSG
part. I just want to know if there is going to be a requirement
forbidding us from putting our serialized XML into the MSG part. I was
getting that impression. I want to continue to work together, I really
don't want to invent something different. 

NOTE: We have 47 different healthcare vendor products signed up to test
RFC 3881 over syslog at a connectathon in January 2006. Companies big
and small in the healthcare space including: GE, Siemens, Philips,
McKesson, Kodak, Canon, Agfa, IBM, etc. We would like to use 3195, but
you all know the problems there. Thus we are using BSD SYSLOG and
violating the MTU. We are making do with what we have, we are trying to
'wait' for you. We appreciate what Rainer is doing, and support him in
his efforts to document (standardize) what is used today. 

John 

> -----Original Message-----
> From: Rainer Gerhards [mailto:[email-masked]] 
> Sent: Wednesday, November 23, 2005 9:50 AM
> To: Darren Reed
> Cc: Moehrke, John (GE Healthcare); [email-masked]; 
> [email-masked]
> Subject: RE: [Syslog] RE: Message format
> 
> Darren,
> 
> I fully agree with you. My understanding is that John just needs to
> transmit text in the MSG part which co-incidently "looks like" XML It
> must, however, a bit longer than 1K, which is backed by the current
> state of discussion. I, too, strongly object mandating XML or anything
> else formatted in a specific way (other than structured data). I have
> begun to become very sceptic about RFC 3195 (again, I have implemented
> it). I think we need to very carefully evaluate it *after* we have
> finished the base work.
> 
> BTW: my recent findings about the total incompatibility of various
> well-deployed implementations are a strong point that we need to
> standardize the basic format. But just what the bare essentials - and
> the quicker, the better. Already a lot of time has passed.
> 
> Rainer
> 
> > -----Original Message-----
> > From: Darren Reed [mailto:[email-masked]] 
> > Sent: Wednesday, November 23, 2005 4:44 PM
> > To: Rainer Gerhards
> > Cc: Moehrke, John (GE Healthcare); Darren Reed; 
> > [email-masked]; [email-masked]
> > Subject: Re: [Syslog] RE: Message format
> > 
> > > I think this is a valid use case. Syslog traditionally 
> has not only
> > > focussed on network management but has always been used for
> > > application-layer event notifications. I think what John 
> asks for is
> > > within our charter and doesn't even require any change to 
> > what we have
> > > been discussing so far.
> > 
> > So long as XML in the message can be satisfied by saying it is part
> > of the "MSG" section, then yes.  I don't believe there are 
> any planned
> > restrictions on what the text content of "MSG" can be.
> > 
> > Otherwise we're just going back down the road of 3195.
> > 
> > If John wanted to see XML in syslog formalised, then my 
> vote would for
> > it to be a follow on draft that documented a particular SD-ID as the
> > means for indicating the MSG was expected to be XML.
> > 
> > But I cannot emphasise strongly enough that it is not 
> appropriate for
> > this group to take on syslog and XML, beyond what exists in 3195, at
> > the present time.  We need to focus on the charter and 
> achieve a basic
> > set of goals first before moving on to things like this.  This isn't
> > to say that it won't be addressed, but not here and now.  
> If this puts
> > you, John, in uncertain land for the time being then I 
> think that has
> > to just be accepted with an understanding that it can be 
> redressed at
> > some point in the future, even if it doesn't make our 
> current charter.
> > 
> > Darren
> > 
> 

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Chris Lonvick <[email-masked]>
Date: Wed, 23 Nov 2005 09:15:24 -0800 (PST)

Hi John,

> don't want to invent something different.

I don't think that we want to prohibit any future, useful applications of 
syslog.  As others have said, we're going to focus on getting the document 
out the door right now so please keep reviewing the work so that your 
ideas can be implemented.

> his efforts to document (standardize) what is used today.

Valid reasons to update 3195 when we have syslog-protocol nailed down.

Thanks,
Chris