Hi John,
This looks good. It has a low complexity factor and doesn't change
the existing messages.
There has been a lot of discussion on the list -and I've received
several comments separately- of the time format in the existing
messages. Since the syslog-syslog ID is only documenting the current
message format we can't change that. Also, the intent of the overall
system has been that the messages would be reviewed fairly soon after
they were generated and would not really need a year marker. It was
also considered that the messages would have local significance and
that the administrators would know the timezone of the device
generating the message. Does it make sense to include an optional
timestamp in the body of the message that gives more robust details
of the time?
Speaking of time, as you're writing you may want to consider what
should happen if the device doesn't generate messages very often.
As you mention in "d", it will need to be tunable to provide good
redundancy coverage. However, what could happen if the device is
configured to generate a block after 5 messages, but the device only
generates 4 messages within an hour and then just sits there for the
next week without any further activity? I wouldn't want the block to
be lost if the device is rebooted during that later time. Perhaps it
would be good to put a note in the draft that says that the block may
be sent even if it is not full to the configured capacity.
Thanks,
Chris
At 05:27 PM 2/5/01 -0500, John Kelsey wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>
>Guys,
>
>I've been working on the syslog-sign draft, particularly
>dealing with the problem of (more-or-less) real-time
>signature verification. I wanted to summarize some of what
---remainder deleted for brevity---
