RE: [Syslog] RE: byte-counting vs special character

Balazs Scheidler <> Thu, 17 August 2006 20:25 UTC

Received: from [] ( by with esmtp (Exim 4.43) id 1GDoR7-0001Dv-6B; Thu, 17 Aug 2006 16:25:53 -0400
Received: from [] ( by with esmtp (Exim 4.43) id 1GDoR5-0001BY-Qz for; Thu, 17 Aug 2006 16:25:51 -0400
Received: from ([]) by with esmtp (Exim 4.43) id 1GDoEJ-0001SP-Ft for; Thu, 17 Aug 2006 16:12:40 -0400
Subject: RE: [Syslog] RE: byte-counting vs special character
From: Balazs Scheidler <>
To: Chris Lonvick <>
In-Reply-To: <>
References: <0bfb01c6c199$01c71860$> <>
Content-Type: text/plain
Date: Thu, 17 Aug 2006 22:12:32 +0200
Message-Id: <1155845552.15643.28.camel@bzorp.balabit>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Security Issues in Network Event Logging <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>

On Thu, 2006-08-17 at 07:22 -0700, Chris Lonvick wrote:
> Hi,
> I agree; we don't want a vote here.  We want strong technical reasons for 
> making a decision.

As I see:

We have a technically superior (we all seem to agree on this one)
solution that breaks compatibility. Compatibility is important, this is
documented in our charter.

If we are to break compatibility we definitely need to have important
incentives to do so. As I see the byte counter in itself is not
important enough, I would simply forbid LF in messages as a compromise
if that is acceptable to others.

Thus we should not simply stop at adding the byte counter. There are
other features currently missing from the protocol which can only be
implemented with an incompatible change. An important example is
application layer acknowledgements. (not the complex one in
syslog/COOKED but a simpler scheme) What I'm afraid about this path is
that we need to deliver something soon.


Syslog mailing list