> On the other hand, if we started with syslog-as-it-is-today, > added TCP transport, took off the line length limits, > delimited "records" in the TCP stream with newline, and > permitted (as an option) ISO 8601 / RFC 3339 timestamps[1] > instead of the ambiguous and hard-to-sort ones currently > standardized, I think we'd hit most of the essentials. Plus, > with little effort, existing implementations could be frobbed > to interop with it, and I think that spec would describe an > existing mode of extended operation on many of today's > enhanced syslog implementations.
This is exactly my point. Is it really such a bad idea that there is so much opposition inside this WG against this? It sounds so easy to do (even an option in RFC3164 would do) and - based on my discussion with other implementors - would receive quick acceptance... Honestly, I would appreciate if someone could point out why this is so a bad idea. Cheers, Rainer
