At 03:40 PM 2/21/2002 +0100, albert.mietus wrote: >Hai All, > >PROPOSED CHANGE: An extra field is syslog > >Intro: As we have described in rfc3164 for some systems, the HOSTNAME and >DATE field in the HEADER do no carry all needed information: No DNS name, no >year, no milliseconds. As we can't put them in the HEADER, the are put in >(the start of) the MSG part (after TAG). By a lot of systems. > >For normal syslog, this will do, as it is just text and so it's valid in de >MSG. So it will do for syslog-sign too. > >However, I think it would be wise to extent the special syslog-sign messages >with these field. And instead of just add the "somewhere". I would prefer to >do it structural: >When we define an optional field in each syslog message: XHDR, between the >HEADER (with TAG) and the MSG part. And use that field to store those extra >bit's, we document (for new implementations) in which order those extra >information should be >And we can use that definition ourselves in the special syslog-sign >messages. > >To do so, we need some extra text in H2.0 (mention the field), on H2.2 >halfway page 6 (reference it). And add a section (between 2.2 & 2.3 to >describe this optional field. Also an example in (now) 2.4 will be needed. > >In those sections it will be a optional field with a recommended order. In >H3 (or H2.5: "General layout", see above) that field should be recommended, >or better, required > >Wehn we agree with this improvement. I'm willing to donate the proposed >textchanges.
This sounds reasonable. Please put together some proposed text and let's see how it looks. You may find this helpful: http://www.ietf.org/internet-drafts/draft-ietf-impp-datetime-05.txt "Date and Time on the Internet: Timestamps" It's been accepted as a Proposed Standard by the IESG. Other comments? Thanks, Chris
