Subject: RE: Framing in syslog messages - RE: [Syslog]Preliminarysyslog-transport-tls document - issue 3

From: "Rainer Gerhards" <[email-masked]>
Date: Fri, 17 Mar 2006 16:52:40 +0100

Bazsi,

> Agreed, let's go for octet-counting. How would that look like? Two
> octets before every message? That would limit message size to 64k, is
> that sufficient? (I personally say it is, messages larger 
> than 64k would
> potentially mean that they cannot be held in memory)

there is the good, old size issue resurfacing. I'd say let's not get on
that slippery slope again. The compromise so far is - you can use any
size as long as the receiver permits it. I'd say we should stick with
it. That means we should probably also stick with the ASCII-only Space
delimited header. So the transport header would be something like this

TLS-HEAD = OCTCOUNT SP
OCTCOUNT = 1* DIGIT

Two practical samples would be

"140 <rest of syslog message"

or

"256000 <rest of syslog message"

The later is an intentionally horrible long message. But again, I'd
leave this door open.
If the receiver thinks 256000 octets is too large, it can read the first
64k and drop the rest.
Rainer

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Chris Lonvick <[email-masked]>
Date: Fri, 17 Mar 2006 08:37:35 -0800 (PST)

Hi,

Why wouldn't this information be contained in a structured data element 
within each frame?

Thanks,
Chris