Andrew, > In order for us to map older syslog into the new -protocol, > we should at > least reference the existing facilities and levels that are > mentioned in > 3164.
based on the discussion, I now think it is not strictly necessary to specify the table. I think one of Anton's core ideas is that the facility should not be tied to any specific meaning. A facility is just a quick way to filter messages based on a simple, numerical ID. >From what I see at customer installations, this is probably a good description (but I also see that the traditional facilities are widely used in local sysadmin, e.g. for the mail subsystem). With the current version I have under edit, I have not assigned any specific semantical meaning to the facilities, but I have recommended to stay away from the traditional facilities (< 24) unless specifically instructed by the user. > We need a cross reference table in the spec so we can map old to > new and back again. Also, make note of how to map new to old. For > example, if the new code does not directly map to an old > value (via the > cross reference table) it must be set to Local7.Info (or what ever). Actually, there is no mapping to be done. We no longer have this PRI type of thing, that is a single value which specifies two things (facility and severity). Instead, we have two fields, one being the facility (in current in-edit draft unsigned int 32) and one being the severity (in current in-edit draft only values 0..7 - the traditional ones). So there is is need to map it specifically (well, a relay receiving a 3164 message may map a little, but I assume it will simply split the fields - that will go into yet to be written "relay operations" section). Rainer
