David, I went through my notes. Retaining PRI as is is actually a charter item:
--- Reviews have shown that there are very few similarities between the message formats generated by heterogeneous systems. In fact, the only consistent commonality between messages is that all of them contain the <PRI> at the start. Additional testing has shown that as long as the <PRI> is present in a syslog message, all tested receivers will accept any generated message as a valid syslog message. In designing a standard syslog message format, this Working Group will retain the <PRI> at the start of the message and will introduce protocol versioning. --- So we can not change the PRI representation (and thus the representation of severity). >From what I see in my notes, we simply copied over the 3164 text on PRI without any further thinking after we had set on this charter. I think this is the primary reason that it was not better spelled out and be undetected until now. Rainer > > Before we publish the spec as an RFC, is the WG satisfied with this > > restriction of severity to 0-7, and is the WG satisfied that this is > > clear and unambiguous in our spec? > > > > If the WG believes the 0-7 restriction is unacceotable, we will need > > to pull the draft back from the IESG and make changes to PRI. > > The last time a version was submitted (roughly a year ago), it was > pulled back *because* PRI calculation was different from > legacy syslog. > This was the whole point in that discussion. And, yes, then > there wasn't > this restriction. IMHO we can not change that without going into a > "deep-inconsistency-loop" of WG decisions. > > > > If the WG accepts the 0-7, but thinks the draft is not clear and > > unambiguous, then we could provide clarifying text as part of WGLC > > without pulling the draft back from the IESG. > > This is what I'd recommend. A simple sentence like "severities MUST be > in the range of 0 to 7" should do the job. > > Rainer > > > > David Harrington > > [EMAIL PROTECTED] > > [EMAIL PROTECTED] > > [EMAIL PROTECTED] > > > > > > > -----Original Message----- > > > From: Rainer Gerhards [mailto:[EMAIL PROTECTED] > > > Sent: Thursday, December 14, 2006 9:26 AM > > > To: Glenn M. Keeni; [EMAIL PROTECTED] > > > Subject: RE: [Syslog] Dbh re-Review of -mib-11, part 1 > > > > > > So far, just one comment... > > > > > > > 1.6 > > 11) in SyslogSeverity, I recommend removing the > > > > second sentnece > > > > > > in the > > > > > > description "The syslog protocol uses the values 0 > > > > (emergency) > > > > > > to 7 (debug)." since this is already spelled out in > > > > the SYNTAX > > > > > > clause,andshows that 99 (other) is also used. Why do we > > > > > > need 99? Are other > > > > > > values valid? > > > > Partially fixed. When is "other" used? > > > > > > > > Response. > > > > "other" will be used to count messages that do not have > > > > severity in > > > > the range 0-7. The syslog protocol specs (-19.txt) does > > > > not disallow > > > > such messages. > > > > > > Actually, -syslog-protocol disallows this by the way the PRI value > > is > > > specified (this was different in previous versions of the I-D). In > > > short: PRI MOD 8 is severity. So if a severity greater > than 7 would > > be > > > given, it would actually modify the facility. See 6.2.1: > > > > > > -- > > > The Priority value is calculated by first multiplying > the Facility > > > number by 8 and then adding the numerical value of the Severity. > > > -- > > > > > > Rainer > > > > > > _______________________________________________ > > > Syslog mailing list > > > Syslog@lists.ietf.org > > > https://www1.ietf.org/mailman/listinfo/syslog > > > > > > > > > > > _______________________________________________ > > Syslog mailing list > > Syslog@lists.ietf.org > > https://www1.ietf.org/mailman/listinfo/syslog > > > > _______________________________________________ > Syslog mailing list > Syslog@lists.ietf.org > https://www1.ietf.org/mailman/listinfo/syslog > _______________________________________________ Syslog mailing list Syslog@lists.ietf.org https://www1.ietf.org/mailman/listinfo/syslog
