Subject: RE: [Syslog] RE: syslog-protocol draft

From: "Rainer Gerhards" <[email-masked]>
Date: Wed, 14 Dec 2005 15:17:24 +0100

Darren,

an "I would like to see this too" is a good indication that a
controversal feature is required. I have honestly posted what I think so
that all others can jump in. For the rest, see the archive ;)

Rainer 

> -----Original Message-----
> From: Darren Reed [mailto:[email-masked]] 
> Sent: Wednesday, December 14, 2005 3:14 PM
> To: Rainer Gerhards
> Cc: [email-masked]
> Subject: Re: [Syslog] RE: syslog-protocol draft
> 
> > Darren,
> > 
> > I have seen nobody backing your position, so I think it was 
> consensus to
> > ignore these comments.
> 
> And nobody decrying them either.
> 
> So are you saying, you need "me too's" on comments before you'll make
> any replies to issues people bring up ?
> 
> It shouldn't take everyone to speak out about an issue for it to be
> valid, it should only take one.
> 
> If 5 people came back with 5 different issues each, would you ignore
> all 25 because none of them brought up the same one ?  This is meant
> to be the value in peer revue and if you start ignoring comments that
> only get brought up once, you're undermining the efforts and
> effectiveness of this group.
> 
> Darren
> 

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Darren Reed <[email-masked]>
Date: Thu, 15 Dec 2005 01:45:01 +1100 (EST)

> that all others can jump in. For the rest, see the archive ;)

Well, I don't want to disappoint you, but if someone else comes up
with something, I'm not going to "me too" it unless you actively
disagree with it.  Sorry if that spoils your party.  Most of us have
better things to do than send and receive "me too" emails unless they
are a vote.

Back to the issue at hand...for #7, field order...or field details

The "HOSTNAME" field should be constrained, in its definition, to
match that accepted for FQDNs.  "PRINTUSASCII" is too wide.
I believe you need to read RFC 1035.

Similarly, I'd like to see APP-NAME, PROCID and MSGID refined to be
less than the entire character set.  A contradiction in syslog-protocol
is allowing PRINTUSASCII for fields but a field of "-" is used to
indicate it is not there.

..I can imagine some people would like to consider that the HOSTNAME
field should be unrestricted to allow for extended character set names.
Allowing and supporting that should come when & if the IETF decides to
go that way.

Otherwise the comment about "-" is that your grammar is wrong because
you define various fields to be PRINTUSASCII*256 (or whatever the
length is), which specifically includes "-" as being a valid field name.
It isn't.  You document it as representing the absence of any meaningful
data for that field.

If you don't understand the difference here, I think the fields need
to be defined something like this:

field ::= missing | non-dash | PRINTUSASCII*1 PRINTUSASCII*255
missing ::= "-"

Darren

---

From: "David B Harrington" <[email-masked]>
Date: Wed, 14 Dec 2005 10:38:23 -0500

Darren, and others,

Could you please use the issue # in the subject line, preferably one
issue per message, so it is easier to find all of a conversation
related to a specific issue? 

Darren, I tried to find the comments you made while the group was
trying to establish consensus on various items, and see what the
group;'s reaction was to your comments.

I have no idea which messages contained your comments, and I would
find it hard  in the future to locate your current comments (below)
regarding #7, since #7 is not in the subject line of  your email.

Thanks for your cooperation,
David Harrington
[email-masked]

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Darren Reed
> Sent: Wednesday, December 14, 2005 9:45 AM
> To: Rainer Gerhards
> Cc: [email-masked]

---

From: Darren Reed <[email-masked]>
Date: Thu, 15 Dec 2005 07:42:56 +1100 (EST)

> .I can imagine some people would like to consider that the HOSTNAME

And as someone else pointed out to me, PRINTUSASCII includes the space
charactr (0x20), which is used as the field delimeter.  This needs to
be fixed too.

Darren

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 15 Dec 2005 00:42:39 -0500

Can we change the subject line to #7 field order, please?

Thanks,
David Harrington
[email-masked] 

> Sent: Wednesday, December 14, 2005 3:43 PM
> To: Darren Reed
> Cc: [email-masked]

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 15 Dec 2005 00:43:32 -0500

Hi,

Better yet, **I'll** change the subject to #7 field order.

Thanks,
dbh