Rainer Gerhards wrote:
> Hi all,
>
> I am resending this is at seems to have been lost. Sorry if it is a
> duplicate, but I also can't find it in the archives.
>
> I am right now implementing the raw listener. Question: once the raw
> channel is up (let's assume channel 1), is it valid to send an error
> response ("ERR" message) if my syslogd experiences a problem.
In RAW mode, the syslog server (aka collector) sends a MSG, and the
syslog client (the generator of syslog messages) sends a series of ANS
packets. There's nothing in BEEP that would allow the collector to
cleanly abort that stream of ANS messages coming back. Hence, the most
reliable way of making sure this works would be to first attempt to
cleanly close the channel (e.g., send a message on channel 0 to close
channel 1, hoping the client will get the clue) or, if that doesn't
work, simply drop the TCP connection.
My guess is that if your collector has a problem such that it cannot
accept more ANS records coming from the generator, there's really no
good reason to keep the socket open anyway, unless you're running
something else over the same connection.
I suppose another way of dealing with it is to stop sending SEQ for that
channel, letting the window close up, discarding data until you can
accept more.
> I am not totally sure after reading the RFC, so advise is appreciated.
The place you want to look to figure this out is the BEEP RFC, not the
syslog RFC. Syslog-reliable didn't address mid-processing failures.
--
Darren New, San Diego CA USA (PST)
Don't take home left-over tripe.
It'll just digest itself before
you get around to eating it.
