Subject: [OPSAWG] comments on draft-ietf-opsawg-syslog-snmp-00 - truncation

From: Rainer Gerhards <[email-masked]>
Date: Tue, 24 Feb 2009 16:44:33 +0100

Finally, I was able to review the work and think it is quite useful. I
am following the other discussion threads.

There is one thing that I think needs to be spelled out. In syslog,
especially with UDP, there is a very limited minimum maximum message
size.  Especially a human-readable representation of the SNMP
notification can easily go beyond that size.

The syslog transport sender is permitted to send messages larger than
the minimum maximum, in which case a receiver not capable to process
the message size can truncate it. But that truncation happens without
any semantics, it just drops excess octets. The receiver may also drop
the message completely. So this is a somewhat unsecure mode of
operations.

Alternatively, the sender (inside the snmp-to-syslog translator) may
truncate a message if it knows the maximum size to use. Truncation
here may be much better, because the sender has the full context and
may be able to drop optional elements while still sending the most
important information. It may also selectively drop other notification
parts, so that at least a fragment of the message will be received by
the syslog receiver.

Rainer