Hi Rainer and all,
On Mon, 21 Nov 2005, Rainer Gerhards wrote:
Chris & WG
From the meeting, it sounds like we will get many more
implementations if
we continue to use <PRI>... at the start of syslog messages.
##############################################################
This will
allow current receivers to continue to receive messages and
put them in
the right bins.
##############################################################
Does anyone disagree with this?
Yes, disagreement here. For the reasons outline in mail from Friday,
this is *NOT* true. Existing syslog receivers will be broken if we just
stick with <PRI> and do not adjust the other header fields.
Of course, it is doable. For details, review
http://www.mail-archive.com/syslog%40lists.ietf.org/msg00121.html
(around the middle of the post).
From my perspective, I think that having a syslog receiver receive the
message and get it into the right bin is acceptable. If we don't have
that then we are breaking very much. If we can accomplish that, then
receivers will continue to receive the messages and the parsers will have
to be updated.
I believe that the alternative that you're saying, Rainer, is that syslog
transmitters COULD keep their existing headers and our Working Group only
put things in there. If we go with that, then the parsers will still need
to be updated to understand the SD-ID information. I'd prefer to just
keep the <PRI> and modify the rest of the packet.
We need to hear from more people on this.
Thanks,
Chris
_______________________________________________
Syslog mailing list
Syslog@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/syslog
