RE: no interim meeting -- read the rules

["Rainer Gerhards" <rgerhards@hq.adiscon.com>]

> - Syslog: but the message size limit of less then 480 octets 
> seems a problem. Also I like 
> subscription. Adding XML to syslog needs some work. We have 
> to care about a second 
> transport/security mechanism TLS (I don't know if this is a 
> real problem).

Just a clarification: the 480 octets is not the maximum allowed message
size per se. It is the size that a transport must support at a minimum.
It has to do with the difficult problems of error notification in broken
networks (where fragmentation shall be avoided). It is recommended that
all implementations support syslog messages up to 2k and it is allowed
to support larger messages. The transport mapping may set an upper limit
on the message, but only within the bounds outlined.

Anyhow, we tried to keep the header and structured data as small as
possible to leave enough room for actual message content in cases where
we are limited to 480 octets.

Syslog serves at least three purposes:

- alarm notification for system troubles
  (like link down, card plugged, ...)
  This is where the 480 octet limit is important.
- debugging messages (e.g. during setup and testing)
- status messages (e.g. traffic flow)

There is also a forth use-case that has nothing to do with NM:

- application level messages (e.g. IHE)

The 4th case has been intensively discussed. It is a major driver behind
larger message sizes (32+k). Purists say this is not something that
syslog should carry. Histriocans point to the fact that syslog started
as an app-level protocol for sendmail. Practicians (me included) say
that this is a currently widely deployed use case so it is valid by
virtue of that.

Rainer Gerhards

--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>