In some email I received from Roger Marquis, sie wrote:
>
> Carson Gaspar <[EMAIL PROTECTED]> wrote:
> > One correct solution to this is to propogate the timestamp with the
> > message, so the propogation delay isn't an issue, and neither are time
> > differences between the reporting and logging systems.
>
> Time synchronization can also be accomplished by logging to multiple
> hosts. Variances would normally be obvious. Whether or not a timestamp
> is propogated a (primary) timestamp should always be logged at the
> localhost.
>
> Also the lack of timeZONE info in the timestamp is a common gripe. It
> might be worthwhile to add a short field with this info i.e:
> 991019_12:54:02_GMT+8.
The biggest problem I have with that (and what some vendors - Sun! - have
done recently) is it changes the log file format. I don't want to even
begin to think how many 1000s of scripts/programs out there depend on it
looking like it does now.
This problem (log file format) is a separate problem to that of building
a secure syslog protocol. Given the number of people bringing it up now,
perhaps the ULM (mentioned in another email) IEWG needs to be reformed with
new people and new drafts written to provide some competion for what is there
now (puke!).
Darren
