RE: draft-shafer-netconf-syslog-00.txt

["Rainer Gerhards" <rgerhards@hq.adiscon.com>]

> -----Original Message-----
> From: owner-netconf@ops.ietf.org 
> [mailto:owner-netconf@ops.ietf.org] On Behalf Of Phil Shafer
> Sent: Monday, June 19, 2006 10:59 PM
> To: Martin Bjorklund
> Cc: netconf@ops.ietf.org
> Subject: Re: draft-shafer-netconf-syslog-00.txt 
> 
> Martin Bjorklund writes:
> >     From the examples it looks like it might be the MSGID defined in
> >     draft-ietf-syslog-protocol-17.txt?
> 
> Yes, that's it.  I would have used the same term, but "msgid" sounded
> particular to the message instance (like sequence id).  I used event
> name instead, but this is probably just needlessly confusing.

I would prefer to stick with the same terminology as in syslog, because
using different terms for the same things indeed confuse.

> 
> >     Why is priority supported only for structured-data?  
> 
> Traditional syslog daemons don't record these fields, so they
> can't be supported on recorded data.  It seemed too fine a line,
> so I widened it a bit.

Actually, PRI is the only thing that is consistently recorded. It is
defined in 4.1.1 in RFC 3164. In the (rare) case where it is absent,
there are rules outlined in RFC 3164. Traditional syslogds filter
exclusively on PRI. So I strongly suggest to support it for both
formats.

For a discussion on syslog format in the wild, please see:
http://www.syslog.cc/ietf/existing-syslog.html

[snip]

> >  o  For <text-pattern>, does it match the MSG part of a
> >     "structured-data" event, or the entire formatted event?
> 
> Yes, it matches the MSG part:
> 
>    <text-pattern> contains a regular expression (as defined 
> by IEEE Std
>    1003.2/POSIX.2 [5]) which the message of the SYSLOG must 
> match.  Any
>    event whose message string matches this expression is 
> carried in the
>    stream.
> 
> Both 3164 and syslog-protocol call their message payload "MSG", so I
> guess I could s/the message/the MSG part/, but it seems less clear.

I strongly suggest to identify the field by calling it "MSG". The reason
is that in RFC 3164 and syslog-protocol, the term "message" is defined
as the complete syslog message, that is HEADER, [STRUCTURED-DATA], and
MSG (e.g. in 6. of syslog-protocol-17).

Rainer

--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>