> I think, we need to add "/" as valid char in the TAG.
Would it hurt if we just said:
----
The TAG is a string of visible (printing) characters excluding SP,
that MUST NOT exceed 32 characters in length.
The first occurrence of a colon (":") or SP " " character terminates
the TAG
field. Generally, the TAG contains the name of the process that
generated the message. It may OPTIONALLY contain additional
information such as the numerical process ID of that process bound
within square brackets ("[" and "]"). A colon MUST be the last
character in this field.
To be consistent with the format described in RFC 3164, a space
character need not follow the colon in normal syslog packets.
----
In essence, that would allow any character but SP and colon to be used.
IMHO, this would not break existing applications and provide more
flexibility in what coud be in the tag. Think of e.g.
Myproc[PID,Threadid]:
>
> At least in the FreeBSD version of syslog (which I'm extending to use
> -sign), the TAG is frequently set to the progname, including its path.
> E.g. "/usr/sbin/cron".
Under Windows, this may be "\usr\sbin\cron". In fact it may even be
"c:\usr\sbin\cron" which includes a colon. So I would prefer to see it
terminated by a SP, but I think this is very dangerous given the current
syslog formats out.
>
> I think this logging the path is smart, as it makes clear which
> program is logging. (I think most systems nowdays have multiple
Me too!
> executables with the same name. I have a least 3 programs named
> "sendmail" :-)
Rainer
