Hi, > > 1. the text below is from sec 4.2.4 > > > > Note that the Global Block Counter crosses Signature Groups; it > > allows one to roughly synchronize when two messages were sent, even > > though they went to different collectors and are part of different > > Signature Groups. > > > > But I am still not quite clear about what the GBC field is for. IMO, > > removing this field does not matter much. Or could you elaborate > > on how it help sync? > > Let's say that you have SG=3 with PRIs <50 going to one collector and > PRIs > >50 going to a different one. The first collector would get some > GBCs and > the other collector would get different ones. Perhaps: > one gets 1,3,5,7,9,11,12,13,14,15,16,17,18 > two gets 0,2,4,6,8,10,19 > From that, you can sort'a tell what's going on, and that you havn't > lost > any.
I am sorry, it seems a little bit hard for me to understand. for collectors, they can tell what sig they lost without GBC. for senders, they have no idea sig blocks lost or not since syslog is a simplex protocol. One more thing, dose the re-sent sig block have the same GBC as the original one? washam _______________________________________________ Syslog mailing list [email protected] https://www.ietf.org/mailman/listinfo/syslog
