Mailing List Archive

It's a tough one. Software that follows standards generally work well
with other software and just makes life less complex. However a lot of
these RFC's are very dated and have not kept track with time and 2001
when rfc3164 was published is a long time ago.

If there is a flag which is not set by default and which is documented
as breaking the standard it might be acceptable to allow longer tags.
Users should break at own risk...

Regards

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards
> Sent: 14 March 2008 09:50
> To: rsyslog-users
> Subject: [rsyslog] Feedback requested - length of syslog tag
>
> Hi all,
>
> I got the following bug report (and patch - thx) for situation where
the
> syslog tag is larger than 32 characters.
>
> http://bugzilla.adiscon.com/show_bug.cgi?id=50
>
> Syslog rfcs prohibit such oversize tags. However, I think seeing them
in
> practice triggers the question if we should really follow RFC 3164 and
> the newer rfcs in this case. Or may it be better to have at least an
> option to allow tags of more than 32 characters?
>
> If you have an opinion, please voice it.
>
> Thanks,
> Rainer
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog

On 2008-03-14, Rainer Gerhards <rgerhards at hq.adiscon.com> wrote:
>
> I got the following bug report (and patch - thx) for situation where the
> syslog tag is larger than 32 characters.
>
> http://bugzilla.adiscon.com/show_bug.cgi?id=50
>
> Syslog rfcs prohibit such oversize tags. However, I think seeing them in
> practice triggers the question if we should really follow RFC 3164 and
> the newer rfcs in this case. Or may it be better to have at least an
> option to allow tags of more than 32 characters?
>
> If you have an opinion, please voice it.
>

I think rsyslog should "be liberal in what it receives and conservative in what
it send". So, maybe allow receiving messages with large tags, but don't send
them out to other rfc3164-expecting servers.

Sending large tags should maybe only be done in RELP.. ?



-jf