> Getting the high resolution timestamp should not be a problem. And > I think that we can agree to constrain the length of the message that > will be carried in the trap.
In -protocol, the max length is sill FIXED at 1024 per message fragment. If a message is large, it MUST be fragmented into multiple fragments. Each of these fragments MUST be 1024 chars max. So you can safely set the max length to 1024 - otherwise we have an invalid syslog message. The same applies in principle to old-style syslog and is defined in RFC 3164 (though some implementations do not abide to this limit). Rainer
