Subject: Re: [Syslog] Small draft for Syslog File Storage?

From: "Rainer Gerhards" <[email-masked]>
Date: Wed, 10 Nov 2010 18:06:54 +0100

Hi Simon,

it looks like I accidently deleted you mail while being on the phone. So I
can not directly reply to it.

The idea of a mime encoding is interesting. Can you point me to a RFC where
you did this? I would be very happy if you could care about the mime parts of
a draft, while I provide some of the encoding that fits what I see as needs
for CEE and many users I know (basic things like no control characters
present, one message per text file line and so).

Thanks,
Rainer

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 10 Nov 2010 19:25:50 +0100

> present, one message per text file line and so).

Hi Rainer.  I did this for DNS data, see RFC 4027.  There are some
idiosyncratic aspects of MIME that needs to be handled, but I don't see
anything that would be a show stopper for a syslog format.

Oh, and please use a timestamp format that embeds the year!  How about
the RFC 3339 format?  I hate how it is impossible to know what year a
log entry was written on modern Linux systems.

/Simon

---

From: Chris Lonvick <[email-masked]>
Date: Thu, 11 Nov 2010 08:18:54 -0800 (PST)

Hi Simon,

> log entry was written on modern Linux systems.

Take a look at RFC 5424.  The timestamp is from RFC 3339.

Thanks,
Chris

---

From: "Rainer Gerhards" <[email-masked]>
Date: Thu, 11 Nov 2010 17:21:40 +0100

> -----Original Message-----
> From: Chris Lonvick [mailto:[email-masked]]
> Sent: Thursday, November 11, 2010 5:19 PM
> To: Simon Josefsson
> Cc: Rainer Gerhards; [email-masked]
> Subject: Re: [Syslog] Small draft for Syslog File Storage?
> 
> Hi Simon,
> 

Sorry for the silence today. I am currently working very hard on very complex
code for log normalization.

But one thing quickly: the timestamp is a typical example of how the real
world is hesitant to change. Rsyslog has become the default syslogd on almost
all modern linux distros. Rsyslog emits RFC3339 stamps be default, and also
uses them by default inside log files. But *all* distros have configured it
to use the old-style timestamp...

Rainer

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 11 Nov 2010 17:25:10 +0100

> to use the old-style timestamp...

Yes, and that is annoying.  Using the RFC 3339 format for stored data
seems like the obvious choice if this is what RFC 5424 is using already.

/Simon

---

From: "Rainer Gerhards" <[email-masked]>
Date: Thu, 11 Nov 2010 17:25:55 +0100

> From: Simon Josefsson [mailto:[email-masked]]
> Sent: Thursday, November 11, 2010 5:25 PM
> To: Rainer Gerhards
> Cc: Chris Lonvick; [email-masked]
> Subject: Re: Small draft for Syslog File Storage?
> 

Actually, I made the switch in rsyslog roughly 4 to 5 years ago, even before
we had RFC5424... :(

Rainer

---

From: "t.petch" <[email-masked]>
Date: Thu, 11 Nov 2010 17:23:41 +0100

Rainer

You might also want to look at RFC4288 and RFC4289.

Tom Petch

----- Original Message -----
From: "Simon Josefsson" <[email-masked]>
To: "Rainer Gerhards" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, November 10, 2010 7:25 PM
Subject: Re: [Syslog] Small draft for Syslog File Storage?

> _______________________________________________
> Syslog mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/syslog