Darren: > > This has been a point of major confusion around syslog RFC > 3164, for > > example. I have personally had to explain over and over to > a lot of > > engineers/managers that it is not a standard and "compliant" > > implementation can send petty much anything yet claim > consistency with > > that RFC. That's what you end up with when you don't have strict > > requirements in the RFC. > > Have you also mentioned to your engineers/managers that all > of the Cisco devices, for years and years, were RFC 3164 compliant ? > > Or that this RFC documents an otherwise undocumented protocol > that they have been implementing for years ? > > What you're describing are organisation problems and not the > domain of this working group to solve.
Well... You say all of Cisco devices "were RFC 3164 compliant". This illustrates my point. What exactly does this compliance mean? My point is that any product can legitimately claim compliance with RFC 3164 and this claim has zero practical usefulness! I don't know what that compliance means, if RFC 3164 says in Sec 4.2: "There are no set requirements on the contents of the syslog packet as it is originally sent from a device. It should be reiterated here that the payload of any IP packet destined to UDP port 514 MUST be considered to be a valid syslog message." So, I can send any UDP message and legitimately claim I am complaint with RFC 3164. In fact, I can show you plenty of examples of very different formats of syslog messages found in the wild in pretty popular implementations. This was one of the reasons, I thought, we initiated the whole syslog-protocol work -- to make a real standard that could serve as authoritative reference for interop. So, when I hear we want another document similar to RFC 3164 in nature, I am a bit concerned if we are repeating the same mistakes. Documenting does not make a standard IMO. Now, one may argue that we could make a more strict informational RFC than RFC 3164. But if we can do an RFC with strict requirements - then make it a standard. I think it is a better investment of WG resources. But obviously consensus opinion rules. Thanks, Anton. _______________________________________________ Syslog mailing list Syslog@lists.ietf.org https://www1.ietf.org/mailman/listinfo/syslog
