Subject: Re: [Syslog] #2, max message size - Need to resolve this

From: Balazs Scheidler <[email-masked]>
Date: Thu, 01 Dec 2005 11:22:49 +0100

On Wed, 2005-11-30 at 11:07 -0800, Chris Lonvick wrote:
> Hi Folks,
> 
> We need to resolve this one.  I've heard from Rainer and a very few 
> others.  I'd like to hear from more people on this.  Choose one:
> 
> __  The maximum message length needs to be defined in syslog-protocol.
> 
> 
> __  The maximum message length should be defined in the transport
>      documents.
> 
> 
> __  I have a different idea....
> 

Is "I don't care" a valid option? I think the setting the maximum
message size is up to the administrator. If we need to define a minimum
to be supported by all implementations, fine. Otherwise the maximum size
depends greatly on the environment where syslog is deployed.

As I see the maximum size needs to be specified only if we are to define
a data type that represents the size of the message, but I can't see
anything like this. (like defining 4 decimal digits, or 32 bit unsigned
integer) 

-- 
Bazsi

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 1 Dec 2005 13:51:04 -0500

Hi Chris,

You have framed the question incorrectly.

This discussion is about the "minimum maximum message length", not the
"maximum message length". This is about "at least this big" and not
about "no bigger than".

All receivers MUST be able to handle the minimum maximum message size
X, and it is RECOMMENDED that all receivers be able to handle messages
of size Y, and receivers MAY choose to support sizes larger than Y. 

Senders can rest assured that any standard-compliant receiver WILL be
able to handle messages of size X, so the sender can send a message of
that size or less and not worry about it being truncated or dropped
(so if it is a critical message, keep the message shorter than X).
Senders can rest assured that most, but not all, compliant receivers
WILL be able to handle messages of size Y, but there is a chance of
the message being truncated or dropped, so if the message is important
but you can live with it being dropped, then keep the message shorter
than Y, and it will usually work. Senders can try to send messages
larger than Y, but many receivers will be unable to handle such a
size.

Transport mappings may apply different constraints, but regardless of
the transport, a compliant implementation MUST support the
transport-independent limit X, and it is RECOMMENDED that the
transport-independent limit Y be supported for improved
interoperability. If desired an implemntation MAY allow larger sizes.

Writers of transport mappings should pay attention to these limits.
All transport mappings MUST support at least size X. If the transport
can support size Y, then the transport mapping contraint should be set
to no less than size Y, and for consistency with the
transport-independent recommendation, SHOULD RECOMMEND support for
size Y (rather than for size Y+1 or Y+2 or Y-7 or ...). If a transport
mapping can handle sizes larger than Y, then the transport mapping can
support larger messages, and MAY choose to set transport-specific
contraints larger than Y.

Is this strictly about which transport mapping is used? No, it is not!
It establishes some standards that should be followed regardless of
the transport used, if possible - all implementations MUST support
size X, SHOULD support size Y, and MAY support larger sizes. 

Dbh

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Chris Lonvick
> Sent: Wednesday, November 30, 2005 2:08 PM
> To: [email-masked]
> Subject: [Syslog] #2, max message size - Need to resolve this
> 
> Hi Folks,
> 
> Please VOTE NOW!
> Thanks,
> Chris

---

From: Chris Lonvick <[email-masked]>
Date: Thu, 1 Dec 2005 11:35:57 -0800 (PST)

Hi David,

> You have framed the question incorrectly.

That became evident when people started responding.  :)

It appears that we have consensus that:

- Rainer will place a recommendation of lengths into syslog-protocol so
   that recievers will have some expectations and,

- transport documents will contain a not-to-exceed length requirement.

Thanks,
Chris