I'd like to insert my 2 cents if I may. I agree that multi-part messages are good to have in the protocol. For two reasons:
- messages greater than 1024 octets - better presentation of multi-line messages The lines breaks fall into the latter category. I think one would achieve better presentation with legacy servers if messages are split into multiple parts on line breaks. This way every line in a log file would have a standard header. I think allowing line breaks brings up the whole can of worms as to how things are stored, which syslog specifications currently shy away from. Also sending only \n means that I have to search contents of every message that is provided to my syslog logger library in order to replace platform-dependent line breaks with \n. Seems very UNIX-biased. Finally, if messages are stored with extra line breaks in log files, how does any parser distinguish a new message from a continuation of a previous one? The line break is currently taken to mean just one thing in the logs - end of message. Multi-part messages would extend this to mean an end of message part. If we add another meaning, we have to say how parsers should tell them apart. There is one issue with not supporting line breaks though (other than the overhead of multi-part messages). If multi-part messages are used for both scenarios I outlined above, then how do we distinguish one from another. Suppose I want to reconstruct the actual message text of a multi-part message on the receiving end in order to send it somewhere as one piece using a different protocol. If multi-part message was a result of splitting a 1500k message, then I should just combine the multiple parts. However, if multiple parts where there for better presentations (because original message contained line breaks), then I need to combine the parts with line breaks. Is it a big deal? Any thoughts? Thanks, Anton. > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Albert Mietus > Sent: Thursday, September 04, 2003 4:33 PM > To: Rainer Gerhards > Cc: Albert Mietus; [EMAIL PROTECTED] > Subject: RE: Issue 8: Length of syslog messages > > > Rainer Gerhards writes: > > > > I would, however, like to extend the core syslog format to > > > support > [...] needs to send a larger message > > Well, I know Microsoft does not necessarily do it smartly. Many > > > ------- BEING LOG ENTRY ;) ----- > [deleted about 3k] > > -------- END LOG ENTRY ------ > > > Still objections? > > I think it is "silly" to make log-entries of this size. > BUT, it seams > to be happening. Therefore, I agree with Rainer; we should > support it. > And so, we should do it in -sign. > > > BTW, > The same example also shows we NEED to allow '\n' in a logline. > > Chris, can you add it to the issue list? > > I think we shoul only allow \n (1 char) as lin e terminator; each > flatform has to translate it into the correct \r\n, \n \n\r sequence > before "printing it". Then the logmsg is independent. > > > > > -- > ALbert Mietus > Send prive mail to: [EMAIL PROTECTED] > Send business mail to: [EMAIL PROTECTED] > Don't send spam mail! >
