Hi WG, as you may have seen, the draft editor has posted protocol-01:
http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-01.txt First things first: this was a "quick" edit (while not as quick as I hoped... ;)). My main objective was to get out some text as quickly as possible. There are probably some typos and some other minor inconsistencies. Also, some of the descriptions may not be as good as they should be. As the format issue was quite controversal, I try to save a little bit work by providing ONE POSSIBLE text to handle it. But further discussion may go into a different direction. So I tried to make it as understandable as possible while not putting total finishing efforts into it. Once we have decided the final direction, I will either revamp totally or polish the current text. To the content: #1 As said on the list, I used Anton's non-XML proposal. Weighting all the arguments received, I really think we do not actually need XML in syslog, even though syslog is no longer just for human review but also for automatted processes (this in answer to David's question). After finishing the text, I am far more convinced that the simple tagging approach is not only sufficiently enough for transport, but it also is a good solution for syslog in general. In the long term, it can also be used to define payload dictionaries, which may be very useful (should we manage to do this;)). Regarding integrating this into XML-based systems, I think a mapping of what I described now and XML is fairly easy, at least as long as you assume that the message is orginally generated by a syslog device and the brought over to some XML system. #2 I would also like to drag your attention to the fragmentation that I now described. There are some specific implications in regard to syslog-sign. I would appreciate if those deeply involved in -sign could cross-check that this format could actually do the job for -sign. #3 The section on fragmentation is currently missing a recommendation to use a reliable transport. This will be moved in once we have a general concensus. I appreciate comments on these points as well as -protocol-01 in general. I am prepared to do a quick re-edit. Thanks, Rainer
