Hi Darren, > I think that this is getting into message content and that's > outside the charter for this WG.
I think you have mixed this up with the discussion on the loganalysis list and anticipated questions that I have not yet asked and don't intend to - at least not on the syslog-sec list ;) Here is the relevant quote from my mail: > > As such, I am asking for a modification to the current syslog-sign > > draft, specifically section 2.2 (HEADER) where the TIMESTAMP is > > discussed. I suggest that a timestamp as described in [RFC3339] Clearly, I am speaking on the HEADER part, not on MSG. Does this change your view of things? Rainer
