Subject: [Syslog] Request for clarification of RTF 5424 Section 6.2.5 (APP-NAME)

From: "Remeika, James C." <[email-masked]>
Date: Mon, 10 Jun 2013 21:48:29 +0000

The APP-NAME field definition in RCF 5424 header says that "[i]t is a string without further semantics", and the ABNF definition of the field is 1*48PRINTUSASCII, which to my reading indicates that the space character is allowed. The same is true for the field PROCID, which follows APP-NAME: space characters seem to be allowed. How can this be allowed, if the values within the header are delimited by spaces. It seems like the two value sets for APP-NAME and PROCID would be indistinguishable:

++MESSAGE A++
APP-NAME: "cat dog"
PROCID: "rabbit"

++MESSAGE B++
APP-NAME: "cat"
PROCID: "dog rabbit"

Thanks for your consideration,
James Remeika

---

From: t.petch <[email-masked]>
Date: Tue, 11 Jun 2013 09:41:35 +0100

----- Original Message -----
From: "Remeika, James C." <[email-masked]>
To: <[email-masked]>
Sent: Monday, June 10, 2013 10:48 PM

The APP-NAME field definition in RCF 5424 header says that "[i]t is a
string without further semantics", and the ABNF definition of the field
is 1*48PRINTUSASCII, which to my reading indicates that the space
character is allowed.

<tp>

RFC5424 says to me
"      SP              = %d32
      PRINTUSASCII    = %d33-126
"
which says to me that the SP[ace character] is not allowed.

Not sure why we have different readings.

Tom Petch
</tp>

The same is true for the field PROCID, which follows APP-NAME: space
characters seem to be allowed. How can this be allowed, if the values
within the header are delimited by spaces. It seems like the two value
sets for APP-NAME and PROCID would be indistinguishable:

++MESSAGE A++
APP-NAME: "cat dog"
PROCID: "rabbit"

++MESSAGE B++
APP-NAME: "cat"
PROCID: "dog rabbit"

------------------------------------------------------------------------
--------

> _______________________________________________
> Syslog mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/syslog
>

---

From: "Remeika, James C." <[email-masked]>
Date: Tue, 11 Jun 2013 15:08:56 +0000

Tom, 

Thanks very much. I simply missed that text in RCF 5424. However, a humble comment: the line 

SD-NAME         = 1*32PRINTUSASCII
                        ; except '=', SP, ']', %d34 (")

is a little confusing on that front, since it seems to imply that SP is a member of PRINTUSASCII that must be excluded by special comment. I realize now it is just there for emphasis. 

Thanks again,
James Remeika
________________________________________
From: t.petch [[email-masked]]
Sent: Tuesday, June 11, 2013 4:41 AM
To: Remeika, James C.; [email-masked]
Subject: Re: [Syslog] Request for clarification of RTF 5424 Section 6.2.5(APP-NAME)

----- Original Message -----
From: "Remeika, James C." <[email-masked]>
To: <[email-masked]>
Sent: Monday, June 10, 2013 10:48 PM

<tp>

RFC5424 says to me
"      SP              = %d32
      PRINTUSASCII    = %d33-126
"

Tom Petch
</tp>

++MESSAGE A++
APP-NAME: "cat dog"
PROCID: "rabbit"

++MESSAGE B++
APP-NAME: "cat"
PROCID: "dog rabbit"