[EMAIL PROTECTED] schrieb:
Or maybe something else? Are the APP-NAME/PROCID of any use here?
IMHO the easiest solution would be a requirement for every sender to provide APP-NAME/PROCID information.
Then every originator is determined by the triple (HOSTNAME, APP-NAME, PROCID) and every signature group by (HOSTNAME, APP-NAME, PROCID, SG, SPRI).
Section 4.2.2 (about the reboot session ID) also assumes a central syslog process that's tightly coupled with host reboots -- it should be described in terms that make sense in other models, too.
Is it acceptable to use the time(), i.e. seconds since the epoch, as a reboot session ID?
This does "increase whenever an originator reboots" even without the need "to retain the previous Reboot Session ID across reboots" and without any relation to host reboots.
-- Martin _______________________________________________ Syslog mailing list [email protected] https://www.ietf.org/mailman/listinfo/syslog
