On issue #7 - enterprise ID: I am relatively neutral to this idea. But I am trying to understand how it will be used. What are the anticipated use cases for it?
If we want to use it to differentiate messages from a specific vendor because it may provide some additional formatting, then one could also argue that we also need vendor version and potentially vendor product and on and on. If we do provide enterprise ID, does it have to be required and in the header as opposed to structured content? Is filtering on vendor going to be a common use-case? One area of ambiguity, I think, is a situation where components are integrated into other applications. Say component X from one company is integrated into product Y of another company. Component X already does -protocol compliant syslog logging. Which enterprise ID should it use? Should we leave this as nondeterministic or provide recommendations? Another area of potential ambiguity is relaying. Suppose a relay gets a bad message from a Cisco device and needs to fire a diagnostic error message. Does it use its own enterprise ID for this? If so, my collector which catches messages only for vendor Cisco won’t catch this, right? Anton. > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Rainer Gerhards > Sent: Wednesday, February 04, 2004 9:36 AM > To: [EMAIL PROTECTED] > Subject: -protocol open issues > > > Hi WG, > > I have updated my page of open issues in -protocol. I would > appreciate if you could comment on the open issues. They can > be found here: > http://www.syslog.cc/ietf/protocol.html Please note that these are just the issues which have definitely been identified. Others are lurking around, so I will add them when they are discovered ("other things to do" beneath the issues may provide an idea). I try to solve those issues before creating new ones, just so that it is easier to keep track and stay focussed. Any feedback is highly appreciated. Rainer
