Andrew,
That's exactly our experience. 100% same story...
Rainer
-Original Message-
From: Andrew Ross [mailto:[EMAIL PROTECTED]
Sent: Thursday, November 24, 2005 11:20 PM
To: Rainer Gerhards
Cc: [EMAIL PROTECTED]
Subject: RE: [Syslog] New direction and proposed charter
propose we go in that direction.
Rainer
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Glenn
Mansfield Keeni
Sent: Wednesday, November 23, 2005 1:39 PM
To: [EMAIL PROTECTED]
Subject: Re: [Syslog] New direction and proposed charter
Chris/Rainer
]; [EMAIL PROTECTED]
Subject: RE: [Syslog] New direction and proposed charter
Hi Rainer and all,
On Mon, 21 Nov 2005, Rainer Gerhards wrote:
Chris WG
From the meeting, it sounds like we will get many more
implementations if
we continue to use PRI... at the start of syslog
Darren:
WG,
PRIVERSION TIMESTAMP HOSTNAME APP-NAME PROCID [SD-ID]s MSG
I would put the SD-IDs after the message.
The SD-IDs and detailed bits of meaning to the MSG and
without the MSG, are irrelevant. The exception being a
language marker.
I would prefer SD-ID where it is in
If we go for framing, we must use byte-couting, because we have not
outruled any sequence. If we go for octet-stuffing, we must
define an
escape mechanism. Any of this would be helpful for plain
tcp syslog, but
that is definitely a big departure from current syslog.
Please note that
WG,
PRIVERSION TIMESTAMP HOSTNAME APP-NAME PROCID [SD-ID]s MSG
I would put the SD-IDs after the message.
This raises the question of what terminates the MSG part ;)
Using the above syntax, how do you distinguish between [] at the start
of the message from actualy SD-ID data?
I
