Darren: > > WG, > > <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID [SD-ID]s MSG > > I would put the SD-IDs after the message. > > The SD-IDs and detailed bits of meaning to the MSG and > without the MSG, are irrelevant. The exception being a > language marker.
I would prefer SD-ID where it is in example. I would also re-iterate suggestion of having MSGID in the header, which a number of people supported. Those two combined are arguably more important than the MSG part itself. For example (in abbreviated syntax: host.domain.com MyApp proc1234 STARTED_UP [ip=1.1.1.1]: The applications has started I could live without the MSG here if it got truncated. The MSGID and SD-ID are much more important in this case. BTW, the possible truncation of text and its variability (possible substitutable variables) is another reason why MSGID is so useful. It makes it easier for intelligent receivers to do things like event correlation. Thanks, Anton. > > > - replace NUL with an escape sequence upon reception (e.g. <00>) > > Why not \0 ? > > Darren > > _______________________________________________ > Syslog mailing list > Syslog@lists.ietf.org > https://www1.ietf.org/mailman/listinfo/syslog > _______________________________________________ Syslog mailing list Syslog@lists.ietf.org https://www1.ietf.org/mailman/listinfo/syslog
