>>>>> "Chris" == Chris Lonvick <[EMAIL PROTECTED]> writes:
Your layer diagram makes sense.
Chris> For discrepancies (if any) between the IP address of the
Chris> "originator" and the "transport sender", the originator can
Chris> use the [origin ip=...] SDE (Section 7.2).
I'd assume that all data in the content notially is written relative
to the originator, at least notionally.
Now, sometimes, there will be complicated situations for example when
the originator is split across boxes (imagine a system where syslog(2)
was an RPC call rather than a library function that writes to a local
socket) or where you are translating from one logging protocol to
another (say a snmp implementation that generates a syslog message
from a trap).
_______________________________________________
Syslog mailing list
Syslog@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/syslog
