I'd vote for a much larger limit (4 byte prefix = 4MB) to make it more future-proof regardless of the limit set by current version of syslog-protocol. In recent history, XML has increased data size requirements by as much as an order of magnitute. There could be more such developments in the future.
Besides, you don't always have to hold the message in memory. You can stream it to disk, for example, if you are just a collector and wish to support such huge messages. Or is there something in syslog-protocol that requires you to hold it in memory completely? Anton. > -----Original Message----- > From: Balazs Scheidler [mailto:[EMAIL PROTECTED] > Sent: Friday, March 17, 2006 10:15 AM > To: Rainer Gerhards > Cc: [EMAIL PROTECTED] > Subject: RE: Framing in syslog messages - RE: > [Syslog]Preliminarysyslog-transport-tls document - issue 3 > > [ stripped Cc line ] > > On Thu, 2006-03-16 at 16:51 +0100, Rainer Gerhards wrote: > > > My 2 cents... Do the byte counting. Look at the headers of pretty > > > much any successful protocol (TCP, IP, UDP, etc) - they > all specify > > > length of payload. Special character sequence is really > a hack IMO! > > > > After some thinking, I agree with Anton. I, too, think that > > octet-counting is superior, as it leaves the door open for > changes in > > the upper layer. So I now strongly vote for using this approach. > > Agreed, let's go for octet-counting. How would that look > like? Two octets before every message? That would limit > message size to 64k, is that sufficient? (I personally say it > is, messages larger than 64k would potentially mean that they > cannot be held in memory) > > -- > Bazsi > > > _______________________________________________ > Syslog mailing list > [email protected] > https://www1.ietf.org/mailman/listinfo/syslog > _______________________________________________ Syslog mailing list [email protected] https://www1.ietf.org/mailman/listinfo/syslog
