Hi,
On Tue, 22 May 2007, Sam Hartman wrote:
"Chris" == Chris Lonvick <[EMAIL PROTECTED]> writes:
Your layer diagram makes sense.
Chris> For discrepancies (if any) between the IP address of the
Chris> "originator" and the "transport sender", the originator can
Chris> use the [origin ip=...] SDE (Section 7.2).
I'd assume that all data in the content notially is written relative
to the originator, at least notionally.
Yes.
Now, sometimes, there will be complicated situations for example when
the originator is split across boxes (imagine a system where syslog(2)
was an RPC call rather than a library function that writes to a local
socket) or where you are translating from one logging protocol to
another (say a snmp implementation that generates a syslog message
from a trap).
I agree that's something that can happen. I don't think that anything
should be written into the normative sections of the -protocol document to
address that as it has nothing to do with the protocol on the wire.
Perhaps a note in the security considerations section?
With that:
Rainer - Please update the document to reflect the new layering diagram
and definitions.
Glenn - Please use the same layering diagram in -device-mib and use the
counters as suggested.
All - Have a great weekend. :-)
Thanks,
Chris
_______________________________________________
Syslog mailing list
Syslog@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/syslog
