Hi Folks,
I'd like to bring up one more item for discussion. Currently,
messages on the wire are seen in the format of:
<PRI>timestamp...
However, these are often [currently] stored as:
timestamp...
If the signature were made over what it seen on the wire, it
would not match a signature made over what is stored on disk.
I think that our options are:
A). Make the signature over "what's seen on the wire" and wait
for syslog-sign receivers to catch up.
B). Make the signature over "what's been traditionally stored"
and lose some potentially valuable information.
Personally, I'll vote for A. Discussion?
Thanks,
Chris
[Replying to this will go to the list.]
[Please use [EMAIL PROTECTED] to ]
[reply to me separately. ]
