Re: [Syslog] Request for clarification of RTF 5424 Section 6.2.5(APP-NAME)

"Remeika, James C." <jremeika@draper.com> Tue, 11 June 2013 15:09 UTC

Return-Path: <jremeika@draper.com>
X-Original-To: syslog@ietfa.amsl.com
Delivered-To: syslog@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDD1021F84DF for <syslog@ietfa.amsl.com>; Tue, 11 Jun 2013 08:09:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.46
X-Spam-Level:
X-Spam-Status: No, score=-1.46 tagged_above=-999 required=5 tests=[AWL=-0.061, BAYES_00=-2.599, J_CHICKENPOX_15=0.6, J_CHICKENPOX_23=0.6]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z0HMdPYGG9JL for <syslog@ietfa.amsl.com>; Tue, 11 Jun 2013 08:08:58 -0700 (PDT)
Received: from ns.draper.com (ns.draper.com [140.102.2.1]) by ietfa.amsl.com (Postfix) with ESMTP id D93AD21F86D3 for <syslog@ietf.org>; Tue, 11 Jun 2013 08:08:58 -0700 (PDT)
Received: from CAS2.draper.com (cas2.draper.com [140.102.16.162]) by ns.draper.com (PMDF V6.6 #32061) with ESMTPS id <0MO80011UI2XEN@ns.draper.com> for syslog@ietf.org; Tue, 11 Jun 2013 11:08:57 -0400 (EDT)
Received: from MBX2.draper.com ([169.254.1.197]) by CAS2.draper.com ([fe80::41bc:660b:221a:4902%15]) with mapi id 14.03.0123.003; Tue, 11 Jun 2013 11:08:57 -0400
Date: Tue, 11 Jun 2013 15:08:56 +0000
From: "Remeika, James C." <jremeika@draper.com>
In-reply-to: <017901ce667f$80e69d40$4001a8c0@gateway.2wire.net>
X-Originating-IP: [140.102.16.172]
To: "syslog@ietf.org" <syslog@ietf.org>
Message-id: <356019E317654543A61055476ED9844B09F69955@mbx2.draper.com>
MIME-version: 1.0
Content-type: text/plain; charset="us-ascii"
Content-language: en-US
Content-transfer-encoding: quoted-printable
Thread-Topic: [Syslog] Request for clarification of RTF 5424 Section 6.2.5(APP-NAME)
Thread-Index: AQHOZn9xf+DP4LO7dUyoF64urgd8x5kwnLQ7
Accept-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
References: <356019E317654543A61055476ED9844B09F698F0@mbx2.draper.com> <017901ce667f$80e69d40$4001a8c0@gateway.2wire.net>
Subject: Re: [Syslog] Request for clarification of RTF 5424 Section 6.2.5(APP-NAME)
X-BeenThere: syslog@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Issues in Network Event Logging <syslog.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/syslog>, <mailto:syslog-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/syslog>
List-Post: <mailto:syslog@ietf.org>
List-Help: <mailto:syslog-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 11 Jun 2013 15:09:04 -0000

Tom, 

Thanks very much. I simply missed that text in RCF 5424. However, a humble comment: the line 

SD-NAME         = 1*32PRINTUSASCII
                        ; except '=', SP, ']', %d34 (")

is a little confusing on that front, since it seems to imply that SP is a member of PRINTUSASCII that must be excluded by special comment. I realize now it is just there for emphasis. 

Thanks again,
James Remeika
________________________________________
From: t.petch [ietfc@btconnect.com]
Sent: Tuesday, June 11, 2013 4:41 AM
To: Remeika, James C.; syslog@ietf.org
Subject: Re: [Syslog] Request for clarification of RTF 5424 Section 6.2.5(APP-NAME)

----- Original Message -----
From: "Remeika, James C." <jremeika@draper.com>
To: <syslog@ietf.org>
Sent: Monday, June 10, 2013 10:48 PM

The APP-NAME field definition in RCF 5424 header says that "[i]t is a
string without further semantics", and the ABNF definition of the field
is 1*48PRINTUSASCII, which to my reading indicates that the space
character is allowed.

<tp>

RFC5424 says to me
"      SP              = %d32
      PRINTUSASCII    = %d33-126
"
which says to me that the SP[ace character] is not allowed.

Not sure why we have different readings.

Tom Petch
</tp>






The same is true for the field PROCID, which follows APP-NAME: space
characters seem to be allowed. How can this be allowed, if the values
within the header are delimited by spaces. It seems like the two value
sets for APP-NAME and PROCID would be indistinguishable:

++MESSAGE A++
APP-NAME: "cat dog"
PROCID: "rabbit"


++MESSAGE B++
APP-NAME: "cat"
PROCID: "dog rabbit"

Thanks for your consideration,
James Remeika



------------------------------------------------------------------------
--------


> _______________________________________________
> Syslog mailing list
> Syslog@ietf.org
> https://www.ietf.org/mailman/listinfo/syslog
>