<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE lire:dlf-schema PUBLIC
  "-//LogReport.ORG//DTD Lire DLF Schema Markup Language V1.1//EN"
  "http://www.logreport.org/LDSML/1.1/ldsml.dtd">
<lire:dlf-schema superservice="syslog" timestamp="timestamp"
                 xmlns:lire="http://www.logreport.org/LDSML/">

 <lire:title>DLF Schema for Syslog superservice</lire:title>

 <lire:description>
  <para>This is a DLF schema that can be used to represent most
   messages logged through syslog-like daemon.
  </para>
 </lire:description>

 <lire:field name="timestamp" type="timestamp" label="Timestamp">
  <lire:description>
   <para>The timestamp of the logged event.</para>
  </lire:description>
 </lire:field>

 <lire:field name="hostname" type="hostname" default="localhost" label="Host">
  <lire:description>
   <para>The hostname or ip address from which the message was received.</para>
  </lire:description>
 </lire:field>

 <lire:field name="process" type="string" label="Process">
  <lire:description>
   <para>The "process" that logged the event.</para>
  </lire:description>
 </lire:field>

 <lire:field name="pid" type="int" label="PID">
  <lire:description>
   <para>The PID of the originating process that was included in the
    message.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="facility" type="string" label="Facility">
  <lire:description>
   <para>The syslog facility (<constant>kern</constant>,
    <constant>mail</constant>, <constant>local7</constant>, etc.) to
    which the message was logged. This information isn't present in
    all syslog file formats. 
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="level" type="string" label="Level">
  <lire:description>
   <para>The syslog level (<constant>emerg</constant>,
    <constant>notice</constant>, <constant>debug</constant>, etc.) to
    which the message was logged. This information isn't present in
    all syslog file formats. 
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="message" type="string" label="Message">
  <lire:description>
   <para>The logged event message (after the
    <structfield>process</structfield> and
    <structfield>pid</structfield> parts are removed).
   </para>
  </lire:description>
 </lire:field>
</lire:dlf-schema>
