[Syslog] Small draft for Syslog File Storage?

["Rainer Gerhards" <[e-mail]>]

Hi all,

In what we did, we specified the on-the-wire format. However, we did not
specify any format to use when persisting syslog data to a file.

Note that we were very generous when specifying the on-the-wire format, for
example we permit LF, CR, NUL and many other characters considered dangerous
in file formats.

There are many tools available which interpret syslog data stored in text
files. However, different syslog implementations may use slightly different
file formats.

Together with the control character issue, the file format question both has
interoperability AND security issues. I think these would be very easy to fix
if we write a small RFC that specifies how text is to be encoded. It would be
similar, but much smaller to RFC4627 (JSON). Actually, I think we would need
to carry over primarily its section 2.5.

I would volunteer to write an initial draft, but would first like to get some
feedback if this effort has any chance of getting through.

Rainer