[Syslog] Request for clarification of RTF 5424 Section 6.2.5 (APP-NAME)
"Remeika, James C." <jremeika@draper.com> Mon, 10 June 2013 21:48 UTC
Return-Path: <jremeika@draper.com>
X-Original-To: syslog@ietfa.amsl.com
Delivered-To: syslog@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E92221F95EF for <syslog@ietfa.amsl.com>; Mon, 10 Jun 2013 14:48:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.109
X-Spam-Level:
X-Spam-Status: No, score=-1.109 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nl5hD0-ITX45 for <syslog@ietfa.amsl.com>; Mon, 10 Jun 2013 14:48:39 -0700 (PDT)
Received: from ns.draper.com (ns.draper.com [140.102.2.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D3F321F8F85 for <syslog@ietf.org>; Mon, 10 Jun 2013 14:48:38 -0700 (PDT)
Received: from CAS1.draper.com (cas1.draper.com [140.102.16.163]) by ns.draper.com (PMDF V6.6 #32061) with ESMTPS id <0MO700B1X5WU03@ns.draper.com> for syslog@ietf.org; Mon, 10 Jun 2013 17:48:30 -0400 (EDT)
Received: from MBX2.draper.com ([169.254.1.197]) by CAS1.draper.com ([fe80::c434:4163:9a08:a5c5%12]) with mapi id 14.03.0123.003; Mon, 10 Jun 2013 17:48:30 -0400
Date: Mon, 10 Jun 2013 21:48:29 +0000
From: "Remeika, James C." <jremeika@draper.com>
X-Originating-IP: [140.102.16.172]
To: "syslog@ietf.org" <syslog@ietf.org>
Message-id: <356019E317654543A61055476ED9844B09F698F0@mbx2.draper.com>
MIME-version: 1.0
Content-type: multipart/alternative; boundary="_000_356019E317654543A61055476ED9844B09F698F0mbx2drapercom_"
Content-language: en-US
Thread-Topic: Request for clarification of RTF 5424 Section 6.2.5 (APP-NAME)
Thread-Index: AQHOZiI6sLbk/dBWo0KOpHrysEDPcg==
Accept-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Subject: [Syslog] Request for clarification of RTF 5424 Section 6.2.5 (APP-NAME)
X-BeenThere: syslog@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Issues in Network Event Logging <syslog.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/syslog>, <mailto:syslog-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/syslog>
List-Post: <mailto:syslog@ietf.org>
List-Help: <mailto:syslog-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Jun 2013 21:49:48 -0000
The APP-NAME field definition in RCF 5424 header says that "[i]t is a string without further semantics", and the ABNF definition of the field is 1*48PRINTUSASCII, which to my reading indicates that the space character is allowed. The same is true for the field PROCID, which follows APP-NAME: space characters seem to be allowed. How can this be allowed, if the values within the header are delimited by spaces. It seems like the two value sets for APP-NAME and PROCID would be indistinguishable: ++MESSAGE A++ APP-NAME: "cat dog" PROCID: "rabbit" ++MESSAGE B++ APP-NAME: "cat" PROCID: "dog rabbit" Thanks for your consideration, James Remeika
- [Syslog] Request for clarification of RTF 5424 Se… Remeika, James C.
- Re: [Syslog] Request for clarification of RTF 542… t.petch
- Re: [Syslog] Request for clarification of RTF 542… Remeika, James C.