> If syslog client sends a message over TCP/UDP/IP, it by definition has > an IP address. If it send the message locally, then I think 127.0.0.1 > (local IP) is more appropriate.
I think the case we are describing is a very unusual one. It only happens when the device (better said: software running) has no way of *obtaining knowledge* of its IP address. I am not sure if we will find this in reality at all. So it does not matter (at least in my view) that it has an IP address - it can not get hold of it). So I am using a special value to say "I'm clueless". On the other hand, 127.0.0.1 is a valid value - it may be used when a sender talks to a receiver on the same machine. I would like to differentiate these two cases. > But I am assuming that we won't use syslog-protocol through say local > UNIX pipes like syslog does now locally on say Solaris. If we do want > to support that, than we need the case of an unspecified IP. But if > syslog is used over TCP/IP, "unspecified IP" is an oxymoron. As I said... depends. I am talking about a device *having* an IP address but the software not knowing it. If we all agree this is so unlikely that we should not support it, then I think we should fully drop this "last resort rule" - because we are saying it can never apply ;) Rainer > > Anton. > > > -----Original Message----- > > From: Rainer Gerhards [mailto:[EMAIL PROTECTED] > > Sent: Friday, April 23, 2004 9:01 AM > > To: [EMAIL PROTECTED] > > Cc: Anton Okmianski > > Subject: RE: Issue 14: allow unqualified hostname > > > > > > Anton & all, > > > > in IPv6, we have the "unspecified address", which I think is > > exactly what we should use in the case an device does > > actually know nothing about itself (last case in Anton's > > messsage below) it is "0:0:0:0:0:0:0:0". > > > > Some links: > > http://www.iana.org/assignments/ipv6-address-space > > http://www.cisco.com/en/US/products/sw/iosswrel/ios_abcs_ios_t > > he_abcs_ip > > _version_60900aecd800c111d.html > > > > According to RFC 3330 > > (http://www.rfc-editor.org/rfc/rfc3330.txt), I think we can > > also use "0.0.0.0" for IPv4 addressing in this case. > > > > Comments are highly appreciated. > > > > Rainer > > > > > -----Original Message----- > > > From: Anton Okmianski [mailto:[EMAIL PROTECTED] > > > Sent: Monday, April 19, 2004 10:19 PM > > > To: Rainer Gerhards > > > Cc: [EMAIL PROTECTED] > > > Subject: RE: Issue 14: allow unqualified hostname > > > > > > Rainer: > > > > > > I like Devin's suggestion of recommending a specific > > preference order: > > > > > > FQDN > > > Static IPv4/IPv6 > > > Hostname > > > Dynamic IPv4/IPv6 > > > "127.0.0.1" (when everything is unknown) > > > > > > Maybe the language should be a bit more restrictive than > > just SHOULDs > > > and MAYs here. Maybe: "MUST provide FQDN if it is known. > > If unknown - > > > static IP. If unknown -- hostname. If unknown - dynamic IP. If > > > unknown -- (a) can't use syslog or (b) we explain what they should > > > > use." > > > > > > I don't know if we decided on the last one. If syslog is to be > used > > > for remote logging only, then requiring knowledge of at > > least an IP is > > > acceptable. If, however, we expect it to be used in host-local > > > scenarios as well, then we need to clarify what they should > > there when > > > nothing I known. Devin suggested 127.0.0.1. I like it. Maybe also > > > allow an IPv6 equivalent of that as well if it exists. > > > > > > Thanks, > > > Anton. > > > > > > > -----Original Message----- > > > > From: [EMAIL PROTECTED] > > > > [mailto:[EMAIL PROTECTED] On Behalf Of > > Rainer Gerhards > > > > Sent: Monday, April 19, 2004 11:14 AM > > > > To: [EMAIL PROTECTED] > > > > Subject: Issue 14: allow unqualified hostname > > > > > > > > > > > > Hi WG, > > > > > > > > this is in regard to issue 14, which talks about allowing the > > > > unqualified hostname. Based on previous feedback, I think > > > > this is concensus in the WG (see > > > > http://www.syslog.cc/ietf/protocol/issue14.htm> l > > > > for a short > > > > list). > > > > > > > > If nobody objects, I will go ahead and > > > > edit it in the following way: > > > > > > > > Hostname & FQDN SHOULD be used, IP (v4/6) address or "bare" > > > > hostname MAY be used. > > > > > > > > Rainer > > > > > > > > > > > > > > > > > >
