What is the source of information for syslog-ng to treat '@' a valid character in HOSTNAME field of syslog message? RFC 3164 refers to another RFC for the validity of HOSTNAME field. Syslog-ng's Syslog Relay treats '@' a valid HOSTNAME character while forwarding syslog. I am trying to find valid character set to be used in HOSTNAME field of syslog message. So that I would know when a Syslog Relay inserts a new HOSTNAME/IP in the syslog message to be forwarded. Appreciate any pointers. ____________________________________________________________________________________Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV. http://tv.yahoo.com/
On Wed, 08 Aug 2007 13:00:39 PDT, dave said:
What is the source of information for syslog-ng to treat '@' a valid character in HOSTNAME field of syslog message?
Urp. Eeek. Are you saying that your net actually has hostnames that have embedded '@' in them? The mind boggles.....
Is '@' a valid character in HOSTNAME field of syslog message? If YES, I am looking for an RFC reference. At least, SyslogNG treats '@' as valid while relaying such message. RFC 3164 just refers to another RFC for valid HOSTNAME characters. I am just looking for RFC reference which states '@' can be a valid character in HOSTNAME. I couldn't find one. --- Valdis.Kletnieks@vt.edu wrote:
On Wed, 08 Aug 2007 13:00:39 PDT, dave said:
What is the source of information for syslog-ng to treat '@' a valid character in HOSTNAME field of syslog message?
Urp. Eeek. Are you saying that your net actually has hostnames that have embedded '@' in them?
The mind boggles.....
____________________________________________________________________________________ Moody friends. Drama queens. Your life? Nope! - their life, your story. Play Sims Stories at Yahoo! Games. http://sims.yahoo.com/
Is '@' a valid character in HOSTNAME field of syslog message? If YES, I am looking for an RFC reference. At least, SyslogNG treats '@' as valid while relaying such message.
Looks like you haven't seen chain_hostnames() in action. So check that option, and you will be enlightened why syslog-ng accepts @ in the hostnames :) regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.
Well, I am just a user of syslog-ng. When I was using it as a Relay, it was treating '@' a valid character in HOSTNAME field of syslog message. I have no issues with that! I just want to know which RFC states '@' a valid HOSTNAME character. RFC 3164 doesn't state but refers to one more RFC. I couldn't find the right info there. In summary, all I need to know is the Reference to RFC which states '@' can be valid hostname character. If possible, I would also like to see reference for valid character Set for HOSTNAME in syslog message. cheers +D --- "Geller, Sandor (IT)" <Sandor.Geller@morganstanley.com> wrote:
Is '@' a valid character in HOSTNAME field of syslog message? If YES, I am looking for an RFC reference. At least, SyslogNG treats '@' as valid while relaying such message.
Looks like you haven't seen chain_hostnames() in action. So check that option, and you will be enlightened why syslog-ng accepts @ in the hostnames :)
regards,
Sandor
____________________________________________________________________________________ Luggage? GPS? Comic books? Check out fitting gifts for grads at Yahoo! Search http://search.yahoo.com/search?fr=oni_on_mail&p=graduation+gifts&cs=bz
Hi,
Well, I am just a user of syslog-ng. When I was using it as a Relay, it was treating '@' a valid character in HOSTNAME field of syslog message. I have no issues with that! I just want to know which RFC states '@' a valid HOSTNAME character. RFC 3164 doesn't state but refers to one more RFC. I couldn't find the right info there.
You won't find such RFC. @ isn't a valid character in hostnames, that's why syslog-ng uses it as a SEPARATOR character. Chained hostnames look like hostname1@hostname@hostname3 It's quite readable and parseable and you can see the full path the logs traversed. That's why it does exist. regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.
On Thu, 2007-08-09 at 16:17 -0700, dave wrote:
Well, I am just a user of syslog-ng. When I was using it as a Relay, it was treating '@' a valid character in HOSTNAME field of syslog message. I have no issues with that! I just want to know which RFC states '@' a valid HOSTNAME character. RFC 3164 doesn't state but refers to one more RFC. I couldn't find the right info there.
In summary, all I need to know is the Reference to RFC which states '@' can be valid hostname character. If possible, I would also like to see reference for valid character Set for HOSTNAME in syslog message.
syslog-ng predates RFC3164, and I don't know about any RFC that states '@' should be ok in hostnames. AFAIK hostnames can only contain [\-a-zA-Z0-9] syslog-ng only checks hostnames if check_hostnames() is enabled, otherwise everything till the first space is assumed to be a hostname. The '@' character is accepted even by check_hostnames() because of chain_hostnames(), exactly as Sandor explained. -- Bazsi
On Fri, 2007-08-10 at 12:53 +0200, Balazs Scheidler wrote:
On Thu, 2007-08-09 at 16:17 -0700, dave wrote:
Well, I am just a user of syslog-ng. When I was using it as a Relay, it was treating '@' a valid character in HOSTNAME field of syslog message. I have no issues with that! I just want to know which RFC states '@' a valid HOSTNAME character. RFC 3164 doesn't state but refers to one more RFC. I couldn't find the right info there.
In summary, all I need to know is the Reference to RFC which states '@' can be valid hostname character. If possible, I would also like to see reference for valid character Set for HOSTNAME in syslog message.
syslog-ng predates RFC3164, and I don't know about any RFC that states '@' should be ok in hostnames. AFAIK hostnames can only contain [\-a-zA-Z0-9]
syslog-ng only checks hostnames if check_hostnames() is enabled, otherwise everything till the first space is assumed to be a hostname.
The '@' character is accepted even by check_hostnames() because of chain_hostnames(), exactly as Sandor explained.
BTW: there's a new knowledge base article on our webpage related to this issue, here: http://www.balabit.com/support/knowledge_base/articles/KB1068.bbq -- Bazsi
Thanks for the historical reasons. I would like rephrase my question as below: If I were to implement a standard compliant Syslog Relay, do I need to treat '@' a valid character in the HOSTNAME field of syslog message to be relayed? For e.g.: Input syslog to Relay- <34>Jan 23 11:11:11 host@nm MSG Output from Relay - <34>Jan 23 11:11:11 host@nm MSG i.e. The relay didn't insert new hostname/ipAddress while forwarding. Is this a standard compliant Syslog Relay behavior? Is chaining of hostnames using '@' specific to SyslogNg? cheers +D --- Balazs Scheidler <bazsi@balabit.hu> wrote:
On Fri, 2007-08-10 at 12:53 +0200, Balazs Scheidler wrote:
On Thu, 2007-08-09 at 16:17 -0700, dave wrote:
Well, I am just a user of syslog-ng. When I was using it as a Relay, it was treating '@' a valid character in HOSTNAME field of syslog message. I have no issues with that! I just want to know which RFC states '@' a valid HOSTNAME character. RFC 3164 doesn't state but refers to one more RFC. I couldn't find the right info there.
In summary, all I need to know is the Reference to RFC which states '@' can be valid hostname character. If possible, I would also like to see reference for valid character Set for HOSTNAME in syslog message.
syslog-ng predates RFC3164, and I don't know about any RFC that states '@' should be ok in hostnames. AFAIK hostnames can only contain [\-a-zA-Z0-9]
syslog-ng only checks hostnames if check_hostnames() is enabled, otherwise everything till the first space is assumed to be a hostname.
The '@' character is accepted even by check_hostnames() because of chain_hostnames(), exactly as Sandor explained.
____________________________________________________________________________________Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV. http://tv.yahoo.com/
On Mon, 2007-08-13 at 11:50 -0700, dave wrote:
Thanks for the historical reasons.
I would like rephrase my question as below: If I were to implement a standard compliant Syslog Relay, do I need to treat '@' a valid character in the HOSTNAME field of syslog message to be relayed? For e.g.: Input syslog to Relay- <34>Jan 23 11:11:11 host@nm MSG Output from Relay - <34>Jan 23 11:11:11 host@nm MSG
i.e. The relay didn't insert new hostname/ipAddress while forwarding. Is this a standard compliant Syslog Relay behavior?
Hostname as defined by DNS may not contain '@'.
Is chaining of hostnames using '@' specific to SyslogNg?
yes. -- Bazsi
participants (4)
-
Balazs Scheidler
-
dave
-
Geller, Sandor (IT)
-
Valdis.Kletnieks＠vt.edu