Re: Small draft for Syslog File Storage?

--===============0433319100==
Content-Language: en-US
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
	micalg=SHA1; boundary="----=_NextPart_000_0005_01CB80E3.38DFBE70"

------=_NextPart_000_0005_01CB80E3.38DFBE70
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Sounds like a good idea to me

The biggest step that you need to make from the on-the-wire RFC5424 Syslog is
the specification of a Syslog record separator. In most Syslog log files (as
well as CSV and other multi-record file formats), the typical record separator
is LF or CRLF.
Regardless, in order to define the record separator, you will have to add at
least one more encoding or Syslog syntax requirement on top of the existing
RFC5424 specification, as currently all characters are valid in a Syslog message
portion.

The specification would be fairly straight-forward, as you could just
standardize on the approaches taken by rsyslog and Syslog-ng. Also, RFC5424
provides enough flexibility in character escaping to build on further escaping
for control characters (U+0000 through U+001F) to make this a possibility

In addition, I would like to suggest the addition of an optional file header for
Syslog files. This would allow for easy versioning of the file, allow a place
for products to include additional information, and be able to hold information
such as the vendor, name, and version of the application producing the log. This
would be an especially nice feature when digging through and parsing old Syslog
records

Regardless of the outcome of this discussion, I would like to see a couple of
more optional encodings added to the RFC5424 specification to handle U+0000
through U+001F characters
maybe: \n, \r, \t, and some generic hex encoding for the others \x00 \x01 ...
\x1F


> -----Original Message-----
> From: syslog-bounces at ietf.org 
> [mailto:syslog-bounces at ietf.org] On Behalf Of Rainer Gerhards
> Sent: Wednesday, November 10, 2010 2:24 PM
> To: syslog at ietf.org
> Subject: [Syslog] Small draft for Syslog File Storage?
> 
> Hi all,
> 
> In what we did, we specified the on-the-wire format. However, 
> we did not
> specify any format to use when persisting syslog data to a file.
> 
> Note that we were very generous when specifying the 
> on-the-wire format, for
> example we permit LF, CR, NUL and many other characters 
> considered dangerous
> in file formats.
> 
> There are many tools available which interpret syslog data 
> stored in text
> files. However, different syslog implementations may use 
> slightly different
> file formats.
> 
> Together with the control character issue, the file format 
> question both has
> interoperability AND security issues. I think these would be 
> very easy to fix
> if we write a small RFC that specifies how text is to be 
> encoded. It would be
> similar, but much smaller to RFC4627 (JSON). Actually, I 
> think we would need
> to carry over primarily its section 2.5.
> 
> I would volunteer to write an initial draft, but would first 
> like to get some
> feedback if this effort has any chance of getting through.
> 
> Rainer
> _______________________________________________
> Syslog mailing list
> Syslog at ietf.org
> https://www.ietf.org/mailman/listinfo/syslog


------=_NextPart_000_0005_01CB80E3.38DFBE70
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIKxTCCA2Qw
ggJMoAMCAQICAQEwDQYJKoZIhvcNAQEFBQAwWjESMBAGA1UEChMJbWl0cmUub3JnMR4wHAYDVQQL
ExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxJDAiBgNVBAMTG01JVFJFIENvcnBvcmF0aW9uIFJvb3Qg
Q0EtMTAeFw0wNjA2MDEwNDAwMDBaFw0xODA2MDEwNDAwMDBaMFoxEjAQBgNVBAoTCW1pdHJlLm9y
ZzEeMBwGA1UECxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSQwIgYDVQQDExtNSVRSRSBDb3Jwb3Jh
dGlvbiBSb290IENBLTEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCva1qWPZiEJv5v
MtCbjt0cTu0Nbn15Q1cKqQBXKi8VSH9zZPmPxfWizJJ7JSqFJ5/sLUz3NsnUVjpLYBdFcxNXnOLj
XtmDPFOewm5T98NZc9wRRCiDzt4f8qsHFI19ShPiK3cN5UqtJf+i66QVLA1S6CNL6o2eGAsAl5Wn
xwOh2BfcWU5fNlHDVc9KKAlDDWpHjC2LLHAUbLP4ZzMIJKcLgLKFMtgM2AEfaSHzmi7WUdUHRCtC
blrF7qzPsy/jBLFrr8VcX+mb7saq95pEOilgcix0/naW7kJfM5ph7UBB+S1O/OhH+ZjQ4MjWnwE8
A/YDrQx1OVLAOi29Bsho/l8lAgMBAAGjNTAzMBIGA1UdEwEB/wQIMAYBAf8CAQMwHQYDVR0OBBYE
FMdwUQDYTf7kAdRolsU9n5qX/nQvMA0GCSqGSIb3DQEBBQUAA4IBAQAa+fVfCljimBlcfWwkfJXu
XNKWun9xloFKjnq6SPGgAIKi5LUDil60a0NaNGoGSO3I1xzYt7ncayh21qXulcVTDFqubSJdv51a
HTuJYcYUX72LN/gSq03UVLBCJzYm7ZLUlkb2YLo7xUeZ3coLFcT5AHR36kjG4cYHqXgH0liBl8jx
pN0gwgaci4sgPLUj1w4t8zoKH+zxGFwXwTP/P+etQqiJZ5T00fLLm5kz9mmnxxmmIvUGNdsCAhGh
dnF24pcrR43LNgyOBJ9DPUHBNq3kUQRO48WBKxBxflOtKzsICx/HEtIABcZn7deADHcY9spULZfB
nQYdEpyz5tgh7Y2qMIIDcTCCAlmgAwIBAgICL4swDQYJKoZIhvcNAQEFBQAwXTESMBAGA1UEChMJ
bWl0cmUub3JnMR4wHAYDVQQLExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxJzAlBgNVBAMTHk1JVFJF
IENvcnBvcmF0aW9uIFByaW1hcnkgQ0EtMTAeFw0wOTA3MDIxNzAxNTVaFw0xMDEyMjQxNzAxNTVa
MGExEjAQBgNVBAoTCW1pdHJlLm9yZzEPMA0GA1UECxMGcGVvcGxlMRowGAYKCZImiZPyLGQBARMK
aGVpbmJvY2tlbDEeMBwGA1UEAxMVSGVpbmJvY2tlbCBXaWxsaWFtIEouMIGfMA0GCSqGSIb3DQEB
AQUAA4GNADCBiQKBgQCiPxyMbPx4hedlMNuj2CkE0lREfhUCAVkpyUGSAEoLgMLrHb8j7Abcp7EE
JmFyIyZkE8GVucA0JVWqj784ldfRpYH6PXmj57BBTFdgA0/WLp8zZWHBAGsv/l+QMuars7nEIYuK
F0Hlu9RjlFLoElcqv6O1RbmNAzJb92yuNPBVqQIDAQABo4G6MIG3MA4GA1UdDwEB/wQEAwIF4DAd
BgNVHQ4EFgQUX9UwKQB9ivecYmlVUaspMPpnGNAwHwYDVR0jBBgwFoAUh7QPSI1iM0LBLVEaSB7C
nrsKsa0wRAYDVR0fBD0wOzA5oDegNYYzaHR0cDovL3d3dy5taXRyZS5vcmcvdGVjaC9taWkvcGtp
L2NhMV9taXRyZV9vcmcuY3JsMB8GA1UdEQQYMBaBFGhlaW5ib2NrZWxAbWl0cmUub3JnMA0GCSqG
SIb3DQEBBQUAA4IBAQBJCxovAdq1uUba8ejgDii2JG65gjdIDpluQrhsGQNroNpdnXev8MNecCEw
/2RH7kuwHx2lN0G7kSZkp0PTLe+X1vk0fL7m/NWD2G/FVe0umSbrg6Szy++tnkfcTojCodQrY6e8
pjAeMSdlF+3HHuh+wopRDZU+KBUykLqeGI91TZkGQOH66VphXvH7NtwkMnm131pwKLS2myfw9WJu
PYE4pdvLuHb1EqB81RaOD9gNPf5gZBulLpK0XBbmx15c8x3lP0JydjKSsCV4+Y5YwUYcbpMB0nhd
MuRYTmb/6JQFrUwrE+I74xH8i3jL6Vmx3QyooGFvoTp+hfS8PYti0PbyMIID5DCCAsygAwIBAgIB
BTANBgkqhkiG9w0BAQUFADBaMRIwEAYDVQQKEwltaXRyZS5vcmcxHjAcBgNVBAsTFUNlcnRpZmlj
YXRlIEF1dGhvcml0eTEkMCIGA1UEAxMbTUlUUkUgQ29ycG9yYXRpb24gUm9vdCBDQS0xMB4XDTA2
MDYwMzE3MTMyMloXDTEyMDYwMzE3MTMyMlowXTESMBAGA1UEChMJbWl0cmUub3JnMR4wHAYDVQQL
ExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxJzAlBgNVBAMTHk1JVFJFIENvcnBvcmF0aW9uIFByaW1h
cnkgQ0EtMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMjwe1ZdEIKoELdLvENnbkbO
3mVD54ZX5SjxTzFxhvoqhqSJmLOp32xT7J9KvBapJRbJv1BFdiSUN3O0q8H66nvQqwm1RYe+tTsW
SO351FolGrDT9iDRtfWgH60PCKCbABLRsx3iGnEvjOQjeAtMn1AugqQWU3PWZXYy1Grbya+NOytY
vu1p60bDFSoSAn4Jojv14lUfWHl8s3kahay8umLSQibiXdEEX8CrSkaXpOaFOuyM6+wpRw7TybO1
Dk4zGAUtn0887QvsMDk6evgN2WxMprkHAGUcJhpI1QXtkfDIl9ukdNiIoM/vdN2QC/+m6b8dA55K
5UdlBa9SgRnwapkCAwEAAaOBsTCBrjASBgNVHRMBAf8ECDAGAQH/AgECMA4GA1UdDwEB/wQEAwIB
hjAdBgNVHQ4EFgQUh7QPSI1iM0LBLVEaSB7CnrsKsa0wHwYDVR0jBBgwFoAUx3BRANhN/uQB1GiW
xT2fmpf+dC8wSAYDVR0fBEEwPzA9oDugOYY3aHR0cDovL3d3dy5taXRyZS5vcmcvdGVjaC9taWkv
cGtpL3Jvb3RjYTFfbWl0cmVfb3JnLmNybDANBgkqhkiG9w0BAQUFAAOCAQEATW5u664p7N0iAj27
Xl/akjdfkSQpaosf6cNyAHu7utCytFfY1WfRNmvnNDGYkqI3XMFOa18SNjiNsMCH+sFQaO+oyDnP
iIkEZQvlfGGrRpqIm6j//Fgz85bnf1kAM5I61Np7ofCnciRvp9ZB/+u+9i262tgiJPJrvBcqXmge
T9riCc3RPjxqPNmYslOvNLpIifchelJhF7nIge+7RkAUcTJenj8yKwK0J3+PEpgYRQ+V2C62rnjo
huxPgMw/fYoNTOlh3MVl7adwyK1ahPw2a9eOjSWglqoPTaBNeHJqRJZZ6Vi7S55+VAWCfkAqM5m3
tUiVzjsp2dFcTJxnYezaoDGCAr0wggK5AgEBMGMwXTESMBAGA1UEChMJbWl0cmUub3JnMR4wHAYD
VQQLExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxJzAlBgNVBAMTHk1JVFJFIENvcnBvcmF0aW9uIFBy
aW1hcnkgQ0EtMQICL4swCQYFKw4DAhoFAKCCAbAwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAc
BgkqhkiG9w0BCQUxDxcNMTAxMTEwMTkyNjExWjAjBgkqhkiG9w0BCQQxFgQUX7Q9eeDIHdEupoJR
hf30LjilHQ8wZwYJKoZIhvcNAQkPMVowWDAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYI
KoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwBwYFKw4DAhowCgYIKoZIhvcNAgUw
cgYJKwYBBAGCNxAEMWUwYzBdMRIwEAYDVQQKEwltaXRyZS5vcmcxHjAcBgNVBAsTFUNlcnRpZmlj
YXRlIEF1dGhvcml0eTEnMCUGA1UEAxMeTUlUUkUgQ29ycG9yYXRpb24gUHJpbWFyeSBDQS0xAgIv
izB0BgsqhkiG9w0BCRACCzFloGMwXTESMBAGA1UEChMJbWl0cmUub3JnMR4wHAYDVQQLExVDZXJ0
aWZpY2F0ZSBBdXRob3JpdHkxJzAlBgNVBAMTHk1JVFJFIENvcnBvcmF0aW9uIFByaW1hcnkgQ0Et
MQICL4swDQYJKoZIhvcNAQEBBQAEgYAmi75GI8chzEy2nsvUGvmE9P7aDDOSCks58NqmVcDRR93L
RCMeFTsnb9Yh3NT+Lenq0NKrTTUxtLLWMii1iMnuTBshGpii9UDS5WZAIruXqLAwSBw8SCuECOc4
5RMan9t7XWxeZqC3c0lL6d/lOBrCxZ7X6VPNL/mPpTqVUW3erAAAAAAAAA==

------=_NextPart_000_0005_01CB80E3.38DFBE70--

--===============0433319100==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Syslog mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/syslog

--===============0433319100==--