The Syslog Feature
9.2. Criteria for Generating a Syslog Message
Once the RSM is properly conﬁgured, Syslog messages will be generated
1. Data Terminated by NULL Character: Syslog will generate a message
whenever a properly conﬁgured Buffer Mode Port receives data or text
terminated by a NULL character (0x00). The message sent to the Syslog
Daemon will contain header information and the event (buffered data or
text) captured by the RSM. Note that the event written to the buffer port
will also be retained.
If a Buffer Mode Port receives data or text that is not terminated by a
NULL character, it will not be sent out as a Syslog message, but will
be retained by the buffer, providing the maximum Syslog message size
(described in item 2 below) is not exceeded. This prevents the RSM from
sending spurious characters that do not represent actual
text or data.
2. Maximum Syslog Message Size Reached: Syslog messages are limited
to 1024 bytes (including the header). Therefore, if data or text in the
buffer exceeds this limit, the queued message will be sent immediately,
and the rest of the data will be accumulated and forwarded in another,
subsequent message; either when a NULL is detected, or when the
accumulated data (plus header) again
reaches 1024 bytes.
3. Audit Log: If the System Parameters menu has been used to set the
Audit Log feature for the "On - with Syslog" option, then a Syslog
message will be sent each time that an Audit Log record is generated.
Audit Log records will be generated whenever a user connects or
disconnects from a port, whenever a user enters or exits from command
mode, and whenever a user session is disconnected due
to a time out.
4. The Port Parameters Menus are used to enable/disable the Syslog feature
at each port, and also to determine whether or not messages will be sent
while a user is connected to the port. As described in Section 5.7.2, the
Syslog feature can be set to either send all information captured by the
port, or to stop sending messages when a user is connected to that port.