Hi, On Wed, 17 Jun 2009, WashamFan wrote:
Hi, I'd like issue some concerns here. 1. the text below is from sec 4.2.4 Note that the Global Block Counter crosses Signature Groups; it allows one to roughly synchronize when two messages were sent, even though they went to different collectors and are part of different Signature Groups. But I am still not quite clear about what the GBC field is for. IMO, removing this field does not matter much. Or could you elaborate on how it help sync?
Let's say that you have SG=3 with PRIs <50 going to one collector and PRIs
50 going to a different one. The first collector would get some GBCs and
the other collector would get different ones. Perhaps: one gets 1,3,5,7,9,11,12,13,14,15,16,17,18 two gets 0,2,4,6,8,10,19
From that, you can sort'a tell what's going on, and that you havn't lost
any.
2. sec 6.1.1: Does certResendDelay or certResendCount refine the resending behavior after the first normal message is sent or before that or both? Are you saying resending Payload periodically in a long lived reboot session?
Like this: http://www.ietf.org/mail-archive/web/syslog/current/msg02332.html Does the document need more clarification on this?
3. sec 6.1.2: Why not introduce a param called sigMaxCount to specify the max count of hashes in a Signature Block message?
That's limited by the overall length of the syslog message.
4. signer vs. originator an originator is specified as (hostname, app-name, procid) triple. So does a signer? If yes. then an originator can not have multiple signers in the same time, but multiple originators can share the same signer. In the latter case, should every originator exchange its Payload independently?
That's the discussion going on between Pasi and Alex on the list right now.
washam _______________________________________________ Syslog mailing list [email protected] https://www.ietf.org/mailman/listinfo/syslog
Many thanks for your review and comments. Regards, Chris _______________________________________________ Syslog mailing list [email protected] https://www.ietf.org/mailman/listinfo/syslog
