syslog-sec  

RE: Structured Data Elements anywhere in the message?

Anton Okmianski
Wed, 11 Feb 2004 11:35:07 -0800

Rainer:

> I would like to turn to issue 8, that is structured data
> element placement. I have put together the (few) most
> important thoughts here:
>
> http://www.syslog.cc/ietf/protocol/issue8.html
>
> Anton proposed that we
>
> a) allow elements only in their own, well-defined field
> b) merge that with TAG
>
> I personally think a) is a good idea while I am very
> sceptical about b). I would >appreciate any more feedback
> on this issue.

I was actually going to raise the issue of TAG field as another issue if
we don't address it as part of this one.

As you yourself indicated, we are not sure about the whole business of
static and dynamic parts of TAG and what it is supposed to be used for.
I don't think we can allow such ambiguity in the -protocol. Whatever
this field is used for, it must be specified clearly IMO.  When I think
about what TAG field might be used for, I definitely see an overlap with
structured content field in concept.

Anton.