RE: [Syslog] New -protocol document - your comments needed by 25 June

["Rainer Gerhards" <rgerhards at hq.adiscon.com>]

David,

I am not sure if I get you.

Facility is "just" a header field, most often used for filtering on the
collector or relay.

A standard syslog.conf might have

mail.* /var/log/mail.log
syslog.* /var/log/syslog.log

which means that all messages with mail facility are put in the mail.log
bin while those with syslog facility are put in the other bin.

The originator assigns the facility and a realy eventually rewrites it.

Does that help?

Rainer

> -----Original Message-----
> From: David Harrington [mailto:ietfdbh at comcast.net]
> Sent: Friday, June 15, 2007 2:20 PM
> To: 'tom.petch'; 'Chris Lonvick'; 'syslog'
> Subject: RE: [Syslog] New -protocol document - your comments needed by
> 25 June
> 
> Hi,
> 
> Would it be helpful to identify where in the architecture the
> "facility" exists? I think some people think the originator is the
> thing that asks syslog to send a message (is that the facility?),
> while others think the syslog thing that creates the syslog message
> (e.g. syslogd) is the originator.
> 
> dbh
> 
> > -----Original Message-----
> > From: tom.petch [mailto:cfinss at dial.pipex.com]
> > Sent: Thursday, June 14, 2007 11:36 AM
> > To: Chris Lonvick; syslog
> > Subject: Re: [Syslog] New -protocol document - your comments
> > needed by 25 June
> >
> > Um
> >
> > The three syslog layer definitions look good to me, but the
> > five that come after
> > do not seem quite to fit
> >
> > '   o  An "originator" generates syslog content to be carried in a
> >       message.
> >
> >    o  A "collector" gathers syslog content for further analysis.'
> >
> > >From the earlier definition, I think the syslog application
> > layer receives
> > syslog content and generates syslog message, as opposed to
> > generating syslog
> > content.
> >
> > '   o  A "transport sender" passes syslog messages to a specific
> >       transport protocol
> >
> >    o  A "transport receiver" takes syslog messages from a specific
> >       transport protocol.'
> >
> > Again, from the earlier definition of putting messages on the
> > wire, I think that
> > sender and receiver pass to and take from the wire using a
> > specific protocol.
> >
> > Tom Petch
> >
> > ----- Original Message -----
> > From: "Chris Lonvick" <clonvick at cisco.com>
> > To: <syslog at ietf.org>
> > Sent: Wednesday, June 13, 2007 4:55 PM
> > Subject: [Syslog] New -protocol document - your comments
> > needed by 25 June
> >
> >
> > > Hi Folks,
> > >
> > > I'm going to ask that people review the new -protocol document.
> > >
> >
> http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-21.txt
> > >
> > > I'd like to get that back to Sam by the 25th.  I'm not sure
> > that this will
> > > need another IETF Last Call but I'll discuss that with Sam.
> > >
> > > I want to be clear, the comments I'm looking for are those about
> the
> > > changes made to the document from the last IETF Last Call.  The
> vast
> > > majority of the normative sections of the document have
> > been accepted by
> > > the WG and by the IETF.  We will not be making any changes to
> those
> > > sections.
> > >
> > > Thanks,
> > > Chris
> > >
> > > _______________________________________________
> > > Syslog mailing list
> > > Syslog at lists.ietf.org
> > > https://www1.ietf.org/mailman/listinfo/syslog
> >
> >
> > _______________________________________________
> > Syslog mailing list
> > Syslog at lists.ietf.org
> > https://www1.ietf.org/mailman/listinfo/syslog
> >
> 
> 
> 
> _______________________________________________
> Syslog mailing list
> Syslog at lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/syslog

_______________________________________________
Syslog mailing list
Syslog at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/syslog