Hi, I wrote a fairly long message, after your response to Anton, explaining why I thought it would be a good thing, and clarifying how it should be used. Did you not receive it?
dbh > -----Original Message----- > From: Rainer Gerhards [mailto:[EMAIL PROTECTED] > Sent: Monday, February 09, 2004 12:36 PM > To: [EMAIL PROTECTED] > Subject: RE: -protocol open issues > > Hi WG, > > I am coming back to the enterprise ID. Anton posted his opinion 5 days > ago. Besides my "not sure" reply > (http://www.syslog.cc/ietf/autoarc/msg01052.html), we got no > response so > far. > > Given the otherwise healthy discussion, I assume this is not > a priority > for the WG. So I will remove the enterprise ID for -protocol-03 if > nobody speaks up (we can always get it back in at a later time). If > someone sees good reasons to have it in, I would appreciate > comments now > ;) > > Thanks, > Rainer > > > -----Original Message----- > > From: Anton Okmianski [mailto:[EMAIL PROTECTED] > > Sent: Wednesday, February 04, 2004 7:20 PM > > To: Rainer Gerhards; [EMAIL PROTECTED] > > Subject: RE: -protocol open issues > > > > On issue #7 - enterprise ID: > > > > I am relatively neutral to this idea. But I am trying to > > understand how > > it will be used. What are the anticipated use cases for it? > > > > If we want to use it to differentiate messages from a > specific vendor > > because it may provide some additional formatting, then one > could also > > argue that we also need vendor version and potentially > vendor product > > and on and on. > > > > If we do provide enterprise ID, does it have to be required > and in the > > header as opposed to structured content? Is filtering on > vendor going > > to be a common use-case? > > > > One area of ambiguity, I think, is a situation where components are > > integrated into other applications. Say component X from one > > company is > > integrated into product Y of another company. Component X > > already does > > -protocol compliant syslog logging. Which enterprise ID > should it use? > > Should we leave this as nondeterministic or provide recommendations? > > > > Another area of potential ambiguity is relaying. Suppose a > > relay gets a > > bad message from a Cisco device and needs to fire a diagnostic error > > message. Does it use its own enterprise ID for this? If so, my > > collector which catches messages only for vendor Cisco won't > > catch this, > > right? > > > > Anton. > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] On Behalf Of > Rainer Gerhards > > > Sent: Wednesday, February 04, 2004 9:36 AM > > > To: [EMAIL PROTECTED] > > > Subject: -protocol open issues > > > > > > > > > Hi WG, > > > > > > I have updated my page of open issues in -protocol. I would > > > appreciate if you could comment on the open issues. They can > > > be found here: > > > > > http://www.syslog.cc/ietf/protocol.html > > > > Please note that these are just the issues which have > definitely been > > identified. Others are lurking around, so I will add them > > when they are > > discovered ("other things to do" beneath the issues may provide an > > idea). I try to solve those issues before creating new ones, just so > > that it is easier to keep track and stay focussed. > > > > Any feedback is highly appreciated. > > > > Rainer > > > > > > > > >
