Chris, Anton, WG: OK, if we just want to retain the <PRI> and hope that this will lead to the messages go to the right bin and also hope that the syslogd won't be broken, this might indeed be a solution. My understanding was that backwards-compatibility was requested and that would be more than this
I'll do some checks hopefully tomorrow, but think this might be a workable solution. If we take that route, the charter should state our very limited understanding of backwards-compatibility, else this could be another source of a lot of discussion. This is also the reason I am stressing this point so much (do not pretend to do things you don't do...). Rainer > -----Original Message----- > From: Chris Lonvick [mailto:[EMAIL PROTECTED] > Sent: Monday, November 21, 2005 9:58 PM > To: Rainer Gerhards > Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] > Subject: RE: [Syslog] New direction and proposed charter > > Hi Rainer and all, > > On Mon, 21 Nov 2005, Rainer Gerhards wrote: > > > Chris & WG > > > >> > >>> From the meeting, it sounds like we will get many more > >> implementations if > >> we continue to use <PRI>... at the start of syslog messages. > > > > ############################################################## > >> This will > >> allow current receivers to continue to receive messages and > >> put them in > >> the right bins. > > ############################################################## > > > >> Does anyone disagree with this? > > > > Yes, disagreement here. For the reasons outline in mail from Friday, > > this is *NOT* true. Existing syslog receivers will be > broken if we just > > stick with <PRI> and do not adjust the other header fields. > > > > Of course, it is doable. For details, review > > > > http://www.mail-archive.com/syslog%40lists.ietf.org/msg00121.html > > > > (around the middle of the post). > > > > From my perspective, I think that having a syslog receiver > receive the > message and get it into the right bin is acceptable. If we > don't have > that then we are breaking very much. If we can accomplish that, then > receivers will continue to receive the messages and the > parsers will have > to be updated. > > I believe that the alternative that you're saying, Rainer, is > that syslog > transmitters COULD keep their existing headers and our > Working Group only > put things in there. If we go with that, then the parsers > will still need > to be updated to understand the SD-ID information. I'd > prefer to just > keep the <PRI> and modify the rest of the packet. > > We need to hear from more people on this. > > Thanks, > Chris > _______________________________________________ Syslog mailing list Syslog@lists.ietf.org https://www1.ietf.org/mailman/listinfo/syslog
