Hi Chris,
Well spotted! From the Syslog messages I have seen, I would have to agree
that there only seems to be a space following the <PRI> in rare cases.
Usually with non Unix devices such as switches or routers. These devices
generally have their own time stamp format buried further into the message
(WELF format for example). The idea of an OPTIONAL space only adds overhead
to the "Find Valid Timestamp" parsing code that is needed on a relay or
collector.
Cheers
Andrew
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Chris Lonvick
> Sent: Wednesday, 14 February 2001 9:44 AM
> To: [EMAIL PROTECTED]
> Subject: Space?
>
>
> Hi Folks,
>
> I've gotten some review feedback and am doing a grand scrub through
> syslog-syslog-04. Very early on, someone told me that they had seen
> some implementations that have a space character between the <PRI>
> and the TIMESTAMP. I've looked through some snips of code and
> have generated messages from several devices. Those that do have
> a real TIMESTAMP just start that immediately after the ">". Some
> devices that don't have a valid TIMESTAMP will sometimes place a
> space or other character after the ">".
>
> Unless someone objects, I'm going to change what is written in
> syslog-syslog to remove the reference to the "optional space after
> the PRI field". From what I've seen, syslogd is always looking
> for strftime in the format of "%h %e %T " immediately after the ">".
>
> Your comments and thoughts appreciated.
>
> Thanks,
> Chris
> (replying to this will go to the list)
> (send to [EMAIL PROTECTED] for separate replies)
>
