Space banner This space provides the same content as before, but the organization of the home page has changed. The content is now organized based on logical branches instead of legacy book titles. We hope that the new structure will help you quickly find the content that you need.

Framing characters

Data arrives at a TCP/IP receiver in an undifferentiated stream. There is no system-provided delineation of individual records. For syslog over TCP/IP, different implementations over the years have used different schemes for delineating individual syslog messages either with record terminator characters (called non-transparent framing) or by preceding each message with a count (called octet counting). For more information, see Message transfer in http://tools.ietf.org/html/rfc6587.

Line feed, ASCII 10 or 0x0a, is the most common framing character and is known to be used by rsyslog and Cisco PIX firewalls. (Rsyslog also has an option to use octet counting.) Line feed is specified in SyslogDefender as LF or lf.

Null, ASCII 0, is the second most common framing character and is used by the NetScreen firewall. Null is specified in SyslogDefender as NULL, NU, null, or nu.

Other syslog senders use carriage Return, ASCII 13 or 0x0d and Carriage Return plus Line Feed sequences. Carriage return is specified in SyslogDefender as CR or cr. Carriage return plus line feed is specified in SyslogDefender as CRLF or crlf.

Octet counting is an alternative to framing characters. Octet counting is specified in SyslogDefender as OCTET, O, octet, or o.

BMC recommends octet counting to non-transparent framing. Always use octet counting for SyslogDefender-to-SyslogDefender connections.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*