From owner-freebsd-security  Sun Oct 18 08:15:21 1998
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id IAA23238
          for freebsd-security-outgoing; Sun, 18 Oct 1998 08:15:21 -0700 (PDT)
          (envelope-from owner-freebsd-security@FreeBSD.ORG)
Received: from lariat.lariat.org (lariat.lariat.org [206.100.185.2])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id IAA23232
          for <security@FreeBSD.ORG>; Sun, 18 Oct 1998 08:15:19 -0700 (PDT)
          (envelope-from brett@lariat.org)
Received: (from brett@localhost)
	by lariat.lariat.org (8.8.8/8.8.6) id JAA12983;
	Sun, 18 Oct 1998 09:14:19 -0600 (MDT)
Message-Id: <4.1.19981018091111.0411fef0@mail.lariat.org>
X-Sender: brett@mail.lariat.org
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.1 
Date: Sun, 18 Oct 1998 09:13:05 -0600
To: "Jeffrey J. Mountin" <jeff-ml@mountin.net>, "Jan B. Koum " <jkb@best.com>,
        Sheldon Hearn <axl@iafrica.com>, Igor Roshchin <igor@physics.uiuc.edu>
From: Brett Glass <brett@lariat.org>
Subject: Re: syslogd and syslog.conf (new feature)
Cc: security@FreeBSD.ORG
In-Reply-To: <3.0.3.32.19981018011033.00fc17e8@207.227.119.2>
References: <19981017134231.C22818@best.com>
 <XFMail.981017154818.vev@michvhf.com>
 <199810171855.NAA18114@set.spradley.tmi.net>
 <XFMail.981017154818.vev@michvhf.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

At 01:10 AM 10/18/98 -0500, Jeffrey J. Mountin wrote:
 
>One last thought about syslogd.  If you consider the default setup for
>syslog.conf and the fact that *most* messages are going to one logfile,
>which can get messy and difficult to discern the important from the
>routine.  With that in mind why not have the LEVEL after the FACILITY in
>the log?
>
><date> <host> <program>[<pid>]: <level>: <message>
>
>Programs like ssh and Apache do something along this line.

There's a good reason for this. If you want to delimit the fields
with spaces rather than tabs, it's easiest if one puts the field
that's most likely to contain spaces (e.g. the message) at the
end. Then, when the software parses the line, it can stop treating
spaces as field delimiters at that point. Yes, it's a hack, but
it's used in everything from Apache to inetd.

--Brett


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message