[Syslog] RE: Null character
Andrew: Thanks for that info. I've to admit I've always overlooked this. Eventually, this creates a new situation. Do you think we should support NUL natively (I mean without escaping it, e.g. in 000 as your syslogd does currently)? Rainer -Original Message- From: Andrew Ross [mailto:[EMAIL PROTECTED] Sent: Thursday, November 24, 2005 11:04 PM To: Rainer Gerhards; [EMAIL PROTECTED] Subject: Null character Rainer, FWIIW, I've seen Netscreen, NetGear and some LinkSys devices send a Null character at the end of each message. Not all versions of the firmware would include the Null at the end which leads me to believe it may be a bug in some releases of the firmware. When sending syslog over TCP, Netscreen firewalls will delimit each message with LF NULL. This probably won't have any impact on the 'CLR' since it is the very last character in the message, but I thought I would raise the issue with you as a real-life case of a Null character being used. Cheers Andrew ___ Syslog mailing list Syslog@lists.ietf.org https://www1.ietf.org/mailman/listinfo/syslog
RE: [Syslog] New direction and proposed charter
Andrew, That's exactly our experience. 100% same story... Rainer -Original Message- From: Andrew Ross [mailto:[EMAIL PROTECTED] Sent: Thursday, November 24, 2005 11:20 PM To: Rainer Gerhards Cc: [EMAIL PROTECTED] Subject: RE: [Syslog] New direction and proposed charter Rainer, I agree that 3164 is only really valid with respect to the PRI. When we implemented it in Kiwi Syslog we found no device actually used the 3164 format exactly. Sometimes the hostname was there, sometimes not. Having to write parsing code to work out if a hostname was actually a TAG or not was a huge processing overhead. We now disable 3164 parsing by default. Cheers Andrew ___ Syslog mailing list Syslog@lists.ietf.org https://www1.ietf.org/mailman/listinfo/syslog
Re: [Syslog] Null character
Rainer, FWIIW, I've seen Netscreen, NetGear and some LinkSys devices send a Null character at the end of each message. Not all versions of the firmware would include the Null at the end which leads me to believe it may be a bug in some releases of the firmware. When sending syslog over TCP, Netscreen firewalls will delimit each message with LF NULL. This probably won't have any impact on the 'CLR' since it is the very last character in the message, but I thought I would raise the issue with you as a real-life case of a Null character being used. Buggy software does not equate to a real-life case. But to judge whether or not it is a bug requires knowing what their protocol spec is. In this case, it is a delimeter and that is not something that requires escaping. In fact, it would be a bug to escape it if it were being used in this manner. Darren ___ Syslog mailing list Syslog@lists.ietf.org https://www1.ietf.org/mailman/listinfo/syslog
