RE: Framing in syslog messages - RE: [Syslog] Preliminarysyslog-transport-tls document - issue 3

2006-03-17 Thread Balazs Scheidler
[ stripped Cc line ] On Thu, 2006-03-16 at 16:51 +0100, Rainer Gerhards wrote: My 2 cents... Do the byte counting. Look at the headers of pretty much any successful protocol (TCP, IP, UDP, etc) - they all specify length of payload. Special character sequence is really a hack IMO!

RE: Framing in syslog messages - RE: [Syslog]Preliminarysyslog-transport-tls document - issue 3

2006-03-17 Thread Rainer Gerhards
Bazsi, Agreed, let's go for octet-counting. How would that look like? Two octets before every message? That would limit message size to 64k, is that sufficient? (I personally say it is, messages larger than 64k would potentially mean that they cannot be held in memory) there is the good,

RE: Framing in syslog messages - RE: [Syslog] Preliminarysyslog-transport-tls document - issue 3

2006-03-16 Thread Rainer Gerhards
Baszi, I see the following possible upsides of using some kind of framing: * byte-counted messages, effectively allowing the use of the full character set * application layer acknowledgements, avoid losing messages sitting in the TCP socket buffers without knowing that they were not really

RE: Framing in syslog messages - RE: [Syslog] Preliminarysyslog-transport-tls document - issue 3

2006-03-16 Thread Anton Okmianski \(aokmians\)
] Preliminarysyslog-transport-tls document - issue 3 Hi, This is an issue that we need to discuss. I've had some discussions with various people on this subject who's opinions I trust. They also suggest that we do have 2 options as Rainer states. Let me describe this in a bit more detail

RE: Framing in syslog messages - RE: [Syslog] Preliminarysyslog-transport-tls document - issue 3

2006-03-16 Thread Rainer Gerhards
messages - RE: [Syslog] Preliminarysyslog-transport-tls document - issue 3 Hi, This is an issue that we need to discuss. I've had some discussions with various people on this subject who's opinions I trust. They also suggest that we do have 2 options as Rainer states. Let me