Anton: > > > WG, > > > <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID [SD-ID]s MSG > > > > I would put the SD-IDs after the message. > > > > The SD-IDs and detailed bits of meaning to the MSG and > > without the MSG, are irrelevant. The exception being a > > language marker. > > I would prefer SD-ID where it is in example. I would also > re-iterate suggestion of having MSGID in the header, which a > number of people supported. Those two combined are arguably > more important than the MSG part itself. For example (in > abbreviated syntax: > > host.domain.com MyApp proc1234 STARTED_UP [ip=1.1.1.1]: The > applications has started > > I could live without the MSG here if it got truncated. The > MSGID and SD-ID are much more important in this case. BTW, > the possible truncation of text and its variability (possible > substitutable variables) is another reason why MSGID is so > useful. It makes it easier for intelligent receivers to do > things like event correlation.
I, too, would like to see the MSGID in the header, just as this <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ID]s MSG The issue is that we come closer and closer to the current syslog-protocol-15 header with just the <PRI>. While this would be a workable (and probably good) solution in my point of view, I have heared some voices that would like to see fewer fields. I just caution to pull out APP-NAME and PROCID and leave MSGID, because I would bet more than one virtual can of beer that implementors will say "ah, MSGID is what was called TAG" - and use it in that spirit. That would give us the worst of both worlds... Rainer > > Thanks, > Anton. > > > > > > - replace NUL with an escape sequence upon reception (e.g. <00>) > > > > Why not \0 ? > > > > Darren > > > > _______________________________________________ > > Syslog mailing list > > Syslog@lists.ietf.org > > https://www1.ietf.org/mailman/listinfo/syslog > > > _______________________________________________ Syslog mailing list Syslog@lists.ietf.org https://www1.ietf.org/mailman/listinfo/syslog
