Subject: [Syslog-sec] Message ID in the header

From: "Rainer Gerhards" <[email-masked]>
Date: Wed, 8 Dec 2004 18:37:41 +0100

Hi list,

finalizing syslog-protocol, I realized that SENDER-NAME/-INST is
actually NOT really what TAG was. One usage of TAG was to provide the
SENDER-NAME/-INST information. But it also had an other use: It often
served as a message ID (something like "PIX-3333-3"). We do NOT (yet)
have anything like a message ID in the message header. At least for me,
I was so focussed on the new semantics that I overlooked the other
common use for TAG.

So we have another issue: do we need to include a message ID in the
header? Should we drop it altogether? Or should we add an defined
structured data ID?

Comments are appreciated.

Rainer
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: "Anton Okmianski" <[email-masked]>
Date: Wed, 8 Dec 2004 14:07:13 -0500

I support adding a separate field for message ID. This would make it more
readily available for filtering (easier parsing) than if it were part of a
structured content.  I think it should be optional.  

Thanks,
Anton.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Rainer
Gerhards
Sent: Wednesday, December 08, 2004 12:38 PM
To: [email-masked]
Subject: [Syslog-sec] Message ID in the header

Hi list,

finalizing syslog-protocol, I realized that SENDER-NAME/-INST is actually
NOT really what TAG was. One usage of TAG was to provide the
SENDER-NAME/-INST information. But it also had an other use: It often served
as a message ID (something like "PIX-3333-3"). We do NOT (yet) have anything
like a message ID in the message header. At least for me, I was so focussed
on the new semantics that I overlooked the other common use for TAG.

So we have another issue: do we need to include a message ID in the header?
Should we drop it altogether? Or should we add an defined structured data
ID?

Rainer

---

From: "Andrew Ross" <[email-masked]>
Date: Thu, 9 Dec 2004 12:26:40 +1300

I'll second that. Anything that makes parsing the messages easier to
achieve is good.

Andrew

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Anton
Okmianski
Sent: Thursday, 9 December 2004 8:07 a.m.
To: 'Rainer Gerhards'; [email-masked]
Subject: RE: [Syslog-sec] Message ID in the header

I support adding a separate field for message ID. This would make it
more
readily available for filtering (easier parsing) than if it were part of
a
structured content.  I think it should be optional.  

Thanks,
Anton.

-----Original Message-----

Hi list,

finalizing syslog-protocol, I realized that SENDER-NAME/-INST is
actually
NOT really what TAG was. One usage of TAG was to provide the
SENDER-NAME/-INST information. But it also had an other use: It often
served
as a message ID (something like "PIX-3333-3"). We do NOT (yet) have
anything
like a message ID in the message header. At least for me, I was so
focussed
on the new semantics that I overlooked the other common use for TAG.

So we have another issue: do we need to include a message ID in the
header?
Should we drop it altogether? Or should we add an defined structured
data
ID?

Rainer