David, I am not sure if I get you.
Facility is "just" a header field, most often used for filtering on the collector or relay. A standard syslog.conf might have mail.* /var/log/mail.log syslog.* /var/log/syslog.log which means that all messages with mail facility are put in the mail.log bin while those with syslog facility are put in the other bin. The originator assigns the facility and a realy eventually rewrites it. Does that help? Rainer > -----Original Message----- > From: David Harrington [mailto:[EMAIL PROTECTED] > Sent: Friday, June 15, 2007 2:20 PM > To: 'tom.petch'; 'Chris Lonvick'; 'syslog' > Subject: RE: [Syslog] New -protocol document - your comments needed by > 25 June > > Hi, > > Would it be helpful to identify where in the architecture the > "facility" exists? I think some people think the originator is the > thing that asks syslog to send a message (is that the facility?), > while others think the syslog thing that creates the syslog message > (e.g. syslogd) is the originator. > > dbh > > > -----Original Message----- > > From: tom.petch [mailto:[EMAIL PROTECTED] > > Sent: Thursday, June 14, 2007 11:36 AM > > To: Chris Lonvick; syslog > > Subject: Re: [Syslog] New -protocol document - your comments > > needed by 25 June > > > > Um > > > > The three syslog layer definitions look good to me, but the > > five that come after > > do not seem quite to fit > > > > ' o An "originator" generates syslog content to be carried in a > > message. > > > > o A "collector" gathers syslog content for further analysis.' > > > > >From the earlier definition, I think the syslog application > > layer receives > > syslog content and generates syslog message, as opposed to > > generating syslog > > content. > > > > ' o A "transport sender" passes syslog messages to a specific > > transport protocol > > > > o A "transport receiver" takes syslog messages from a specific > > transport protocol.' > > > > Again, from the earlier definition of putting messages on the > > wire, I think that > > sender and receiver pass to and take from the wire using a > > specific protocol. > > > > Tom Petch > > > > ----- Original Message ----- > > From: "Chris Lonvick" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Wednesday, June 13, 2007 4:55 PM > > Subject: [Syslog] New -protocol document - your comments > > needed by 25 June > > > > > > > Hi Folks, > > > > > > I'm going to ask that people review the new -protocol document. > > > > > > http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-21.txt > > > > > > I'd like to get that back to Sam by the 25th. I'm not sure > > that this will > > > need another IETF Last Call but I'll discuss that with Sam. > > > > > > I want to be clear, the comments I'm looking for are those about > the > > > changes made to the document from the last IETF Last Call. The > vast > > > majority of the normative sections of the document have > > been accepted by > > > the WG and by the IETF. We will not be making any changes to > those > > > sections. > > > > > > Thanks, > > > Chris > > > > > > _______________________________________________ > > > Syslog mailing list > > > Syslog@lists.ietf.org > > > https://www1.ietf.org/mailman/listinfo/syslog > > > > > > _______________________________________________ > > Syslog mailing list > > Syslog@lists.ietf.org > > https://www1.ietf.org/mailman/listinfo/syslog > > > > > > _______________________________________________ > Syslog mailing list > Syslog@lists.ietf.org > https://www1.ietf.org/mailman/listinfo/syslog _______________________________________________ Syslog mailing list Syslog@lists.ietf.org https://www1.ietf.org/mailman/listinfo/syslog
