Robert, a follow-up to my own message. I've searched the mail archive for past discussions and found an interesting one that specifically mentions IHE and RFC 3881. This discussion was the one that is at the core of the message size specification in syslog-protocol, which we are currently discussion. Please note that syslog-protocol will most probably influence the next version of RFC 3195, so the length restrictions made here will most likely apply to any further versions of 3195 (until -protocol is revised itself).
The discussion starts around http://www.syslog.cc/ietf/autoarc/msg01297.html and mentions RFC3888 here http://www.syslog.cc/ietf/autoarc/msg01299.html I guess it is necessary to read the whole thread to fully understand it, the two links provided above are most probably not sufficient. At the bottom line, I think the concensus in the WG was that no current implementation of syslog supports more than 1K messages. I am thinking this because we discussed >1K message as something *totally new* to syslog, not as something that is already being used. *IF* it is in use, we eventually need to change the length restriction in syslog-protcol, even though I do not like the idea at this stage. Comments are deeply appreciated. Rainer > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Robert Horn > Sent: Thursday, May 19, 2005 9:10 PM > To: Marshall Glen <glen.f.marshall > Cc: [EMAIL PROTECTED] > Subject: RE: [Syslog-sec] cooked messages max size > > > Also, a refinement of the RFC 3881can be found at: > > ftp://medical.nema.org/medical/dicom/supps/sup95_fz.pdf > > This takes the general framework of RFC 3881 and further specifies > requirements for how particular events are to be encoded for medical > devices. > > One of the interesting things learned in the early work with > this is that > describing events in XML consumes quite a few bytes. Really > simple events > fit under 1024 bytes, but it does not take much complexity to > push past > that limit. A much more realistic limit to impose is a 64KB > limit. The > commonplace event that "PACS archive sent study X about patient Y to > workstation A to prestage it for physician Z based on current > appointment > schedules" chews up a surprisingly large message if you include full > details about the study, machines, and times. Since these > messages are > defined by multiple schema with namespaces (to manage > inheritance properly) > fully qualified XML tags can become quite large all on their own. > > The ability of the COOKED transport to indicate the schema is > also useful > for the receiving servers so that they can route and parse much more > effectively. > > R Horn > > _______________________________________________ > Syslog-sec mailing list > Syslog-sec@www.employees.org > http://www.employees.org/mailman/listinfo/syslog-sec > _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec
