syslog-sec  

RE: SyslogMIB Issue-#4

Rainer Gerhards
Fri, 30 Jan 2004 09:58:57 -0800

>    Getting the high resolution timestamp should not be a problem. And
> I think that we can agree to constrain the length of the message that
> will be carried in the trap.

In -protocol, the max length is sill FIXED at 1024 per message fragment.
If a message is large, it MUST be fragmented into multiple fragments.
Each of these fragments MUST be 1024 chars max. So you can safely set
the max length to 1024 - otherwise we have an invalid syslog message.
The same applies in principle to old-style syslog and is defined in RFC
3164 (though some implementations do not abide to this limit).

Rainer