Subject: RE: [Syslog] New direction and proposed charter

From: "Rainer Gerhards" <[email-masked]>
Date: Mon, 21 Nov 2005 21:29:31 +0100

> I agree. With <PRI> retained, our server code will not be broken.
> And it can serve as message delimiter so we can pack as many short
> messages before placing it to transport layer delivery.

This is a framing issue. If we want to have multiple messages within a
single UDP packet, syslog-transport-udp must be specified to support
proper framing. We can NOT assume that a value in brackets will never
occur inside a valid message - especially not if we support UTF-8. Or
should we include a rule "MSG MUST NOT CONTAIN <any-number>"? ;)

If we go for framing, we must use byte-couting, because we have not
outruled any sequence. If we go for octet-stuffing, we must define an
escape mechanism. Any of this would be helpful for plain tcp syslog, but
that is definitely a big departure from current syslog. Please note that
currently many syslogds do octet-stuffing and the message TRAILER is LF.

Rainer

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Darren Reed <[email-masked]>
Date: Wed, 23 Nov 2005 03:56:48 +1100 (EST)

..
> currently many syslogds do octet-stuffing and the message TRAILER is LF.

That's unfortunate :(

In nearly all IETF protocols, the message trailer or EOL marker is CR-LF.

Darren