Subject: RE: [Syslog-sec] Detailed Review Comments on Syslog Protocol -09-Part II

From: "Rainer Gerhards" <[email-masked]>
Date: Thu, 14 Apr 2005 17:24:37 +0200

Tom,

thanks for this suggestion, too. I've used the first wording you
provided. I still think that the definition of sender does not change
from section 3, as 3 says "An application that can generate a syslog
message is called a sender". Anyhow, it obviously causes confusion and
so it is better to try to sort this out.

As a side note, I will submit the updated ID tomorrow or monday if I do
not hear any other comments.

Thanks again for all the help,
Rainer

> -----Original Message-----
> From: Tom Petch [mailto:[email-masked]] 
> Sent: Saturday, April 09, 2005 9:38 PM
> To: Rainer Gerhards
> Subject: Re: [Syslog-sec] Detailed Review Comments on Syslog 
> Protocol -09-Part II
> 
> I do not think that it is 'instance' per se that confused me, 
> it is 'instance of
> the sender'.  'Sender' has been given a technical meaning in 
> section 3 and the
> usage here is different, meaning only a part of sender as used before.
> So make it more specific, such as 'instance of the sender's 
> syslog process' (you
> do refer to process id just after)
> 
> Alternatively use a more process-oriented word such 'execution'.
> 
> Tom Petch
> ----- Original Message -----
> From: "Rainer Gerhards" <[email-masked]>
> To: "Tom Petch" <[email-masked]>
> Sent: Thursday, April 07, 2005 4:45 PM
> Subject: RE: [Syslog-sec] Detailed Review Comments on Syslog 
> Protocol -09-Part
> II
> <snip>
> I also have seen that "instance" is probably a bad word, but I lack a
> better one. "Instance" is well defined in the software 
> development space
> (at least I think), but this understanding of instance is 
> obviously not
> universal. A suggestion for a better word would be much appreciated.
> Others might call an instance a reboot, run, job, process, process
> space, incarnation, physical representation, just to give 
> some examples
> (which I think make up for equally-bad words in this context here).
> 
> Rainer
> 
> > -----Original Message-----
> > From: Tom Petch [mailto:[email-masked]]
> > Sent: Thursday, April 07, 2005 2:56 PM
> > To: Rainer Gerhards; [email-masked]
> > Subject: Re: [Syslog-sec] Detailed Review Comments on Syslog
> > Protocol -09-Part II
> >
> > <below>
> > Tom Petch
> >
> <snip>
> 
> 
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 14 Apr 2005 12:33:45 -0400

Hi,

So which wording did you adopt here? Did you use 'instance of the
sender's syslog process'?
I'm not sure that's easier to understand, nor that it better
represents a SENDER-INST, and I'm not quite sure what exactly you want
in this field, nor why, based on the discussion in Appendix A. Some
guidance on WHICH process id would be helpful, if process id is to be
used.

It strikes me that this attribute is not well thought-out. I haven't
been much involved with syslog. Is this attribute supported by
existing running code? Is this something the whole WG agrees should be
standardized?

If the WG wants this standardized, then the text describing it (and
its use case) should be tightened up a lot. I suggest a format be
standardized if possible, based on common operating systems, with
recommendatioins about how to deal with non-common formats. Some
examples might be helpful as well.

If this cannot be tightened up, I recommend it be left out of the
standard.

My $.02
David Harrington
[email-masked]

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> Rainer Gerhards
> Sent: Thursday, April 14, 2005 11:25 AM
> To: [email-masked]
> Protocol -09-PartII