Subject: RE: [Syslog] #2, max message size - Need to resolve this

From: "Rainer Gerhards" <[email-masked]>
Date: Thu, 1 Dec 2005 12:34:36 +0100

I am exactly of Baszi's view - and this is what -15 does. The root cause
of this discussion was that there were suggestions to add a 4 (or was it
5) octect decimal message length counter to the header, which would have
imposed a limit.

No matter what max limit we will set, IMHO no clearly thinking
implementor will obey it, except by default. The admin decides. But
being simplex, we need a guaranteed minimum.

Rainer 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Balazs Scheidler
> Sent: Thursday, December 01, 2005 11:23 AM
> To: Chris Lonvick
> Cc: [email-masked]
> Subject: Re: [Syslog] #2, max message size - Need to resolve this
> 
> On Wed, 2005-11-30 at 11:07 -0800, Chris Lonvick wrote:
> > Hi Folks,
> > 
> > We need to resolve this one.  I've heard from Rainer and a very few 
> > others.  I'd like to hear from more people on this.  Choose one:
> > 
> > __  The maximum message length needs to be defined in 
> syslog-protocol.
> > 
> > 
> > __  The maximum message length should be defined in the transport
> >      documents.
> > 
> > 
> > __  I have a different idea....
> > 
> 
> Is "I don't care" a valid option? I think the setting the maximum
> message size is up to the administrator. If we need to define 
> a minimum
> to be supported by all implementations, fine. Otherwise the 
> maximum size
> depends greatly on the environment where syslog is deployed.
> 
> As I see the maximum size needs to be specified only if we 
> are to define
> a data type that represents the size of the message, but I can't see
> anything like this. (like defining 4 decimal digits, or 32 
> bit unsigned
> integer) 
> 
> -- 
> Bazsi
> 
> 
> _______________________________________________
> Syslog mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/syslog
> 

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "Anton Okmianski \(aokmians\)" <[email-masked]>
Date: Thu, 1 Dec 2005 11:41:13 -0500

I agree. The syslog-transport-udp-06 draft says this regarding maximum size:

"This protocol supports transmission of syslog messages up to 65535 octets in size.  This limit stems from the maximum supported UDP payload of 65535 octets specified in the RFC 768 [1]."

I see no need of restricting it further. For min size it says this:

"IPv4 syslog receivers MUST be able to receive datagrams with message size up to and including 480 octets.  IPv6 syslog receivers MUST be able to receive datagrams with message size up to and including 1180 octets.  All syslog receivers SHOULD be able to receive datagrams with messages size of at least 2048 octets."

Sect 3.2 also has the rational for all of this - minimum MTU size, recommendation to avoid fragmentation, etc...

Anton.  

> [mailto:[email-masked]] On Behalf Of Alexander 
> Clemm (alex)
> Sent: Wednesday, November 30, 2005 9:12 PM
> To: [email-masked]; Chris Lonvick (clonvick); [email-masked]
> Subject: RE: [Syslog] #2, max message size - Need to resolve this
> 
> I think there is general agreement to specify minimum msg 
> size, not maximum msg size in syslog-protocol.  
> 
> Concerning the transport, the same should hold true.  I could 
> see that there may be cases in which a transport might 
> specify a minimum msg size that is larger than the one in 
> syslog protocol (so, if syslog protocol is used over a 
> certain transport, message size may be larger than what
> would be mandated by syslog protocol itself).   I don't see that you
> should mandate to define a max message size for the same 
> reasons we wouldn't define it in syslog-protocol itself.  Why 
> unnecessarily impose constraints when you don't have to?  In 
> other words, just define min sizes that implementations are 
> obliged to support, but don't prevent them from supporting 
> more if they want to.  Just my $0.02.  
> 
> --- Alex
> 
> [mailto:[email-masked]] On Behalf Of Andrew Ross
> Sent: Wednesday, November 30, 2005 2:41 PM
> To: Chris Lonvick (clonvick); [email-masked]
> Subject: RE: [Syslog] #2, max message size - Need to resolve this
> 
> 
> My vote is for the way Rainer has worded it now. Specify the 
> minimum msg size in syslog-protocol and define max message 
> size in the transport documents.
> 
> Cheers
> 
> Andrew
> 
> 
> 
> Hi Folks,
> 
> We need to resolve this one.  I've heard from Rainer and a 
> very few others.  I'd like to hear from more people on this.  
> Choose one:
> 
> __  The maximum message length needs to be defined in syslog-protocol.
> 
> 
> Please VOTE NOW!
> Thanks,
> Chris