> I agree. With <PRI> retained, our server code will not be broken. > And it can serve as message delimiter so we can pack as many short > messages before placing it to transport layer delivery.
This is a framing issue. If we want to have multiple messages within a single UDP packet, syslog-transport-udp must be specified to support proper framing. We can NOT assume that a value in brackets will never occur inside a valid message - especially not if we support UTF-8. Or should we include a rule "MSG MUST NOT CONTAIN <any-number>"? ;) If we go for framing, we must use byte-couting, because we have not outruled any sequence. If we go for octet-stuffing, we must define an escape mechanism. Any of this would be helpful for plain tcp syslog, but that is definitely a big departure from current syslog. Please note that currently many syslogds do octet-stuffing and the message TRAILER is LF. Rainer _______________________________________________ Syslog mailing list Syslog@lists.ietf.org https://www1.ietf.org/mailman/listinfo/syslog
