>> For things like the RFC5424 structured data, the name in name=value >> pairs cannot contain characters such as NUL. >> In my option, what to do if you receive a Syslog message with a NUL in >> the name, is the bigger issue > >Fortunately not. In RFC5424, full UTF-8 is permitted in values. However, the >name alphabet is much more restricted. Out of my head, I think it is US- >ASCII >minus the control character set. During syslog standardization, we did not >see need to support a larger alphabet (but I admit that it is debatable if >national characters should be supported in names -- after long discussion we >said "no").
While it is against the specification, how do you handle the case were an invalid character is included in the name? This is an issue where most programs have issues; they assume that the message will according to the specification. The approach of what to do if an illegal character is encounter should be standardized as well... (though this applies more generally to "what do you do if you receive an invalid name in structured data) Off the top of my head, you have only 1 of 3 choices: (1) strip the offending characters (2) strip the whole name=value pair (3) drop the entire message _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
