> 2. I think requiring UDP implementation reduces the areas in which > syslog message format RFC could be utilized. I can see many different > areas. For example, if RFC came without UDP baggage, we, > within Cisco, > could potentially standardize on this format for products which write > directly to log file (no syslog servers) should be compatible with the > format. This would be a great thing for us to be able to have a > consistent format regardless of whether or not syslog > transport is used > because it is inevitable that some products will use syslog and other > will write straight to file. > > Another use case I have is writing log messages into Windows > Event Log. > I would really like if that format be the same as on other platforms > which use syslog. It would have been easier for us to establish this > requirement for products within Cisco if we could just refer to syslog > message format RFC and it did not come with a baggage of having to > implement a syslog UDP transport, which may not be applicable. > > So, I am open on whether or not UDP binding is included in > -protocol or > outside. But I would really prefer if it was not required.
I agree on your general comments. In fact, that was one of the motivations of splitting -protocol. I think, however, that even if we specify a required transport mapping in -protocol itself, that does not necessarily prohibt this. I think you are talking about storage here. It seems natural that no transport is needed to store the message. I think the implementation requirement can be worded so that a minimal transport mapping needs only to be implemented if the program actually uses a transport. Besides that, I think you can always say that "the format must adhere to RFCxxxx, section 4." - that should leave out any ambiguity. I will comment on the other issue in a summary mail I am right now preparing. Rainer
