Subject: [netmod] I-D Action: draft-ietf-netmod-syslog-model-08.txt

From: [email-masked]
Date: Tue, 10 May 2016 14:14:27 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the NETCONF Data Modeling Language of the IETF.

        Title           : SYSLOG YANG Model
        Authors         : Clyde Wildes
                          Kiran Koushik
	Filename        : draft-ietf-netmod-syslog-model-08.txt
	Pages           : 35
	Date            : 2016-05-10

Abstract:
   This document describes a data model for the Syslog protocol which is
   used to convey event notification messages.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-netmod-syslog-model/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-netmod-syslog-model-08

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-netmod-syslog-model-08

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Clyde Wildes (cwildes)" <[email-masked]>
Date: Tue, 10 May 2016 21:22:48 +0000

Hi,

This update to the draft-ietf-netmod-syslog-model-08 incorporates the changes listed below based on feedback received.

An additional revision to this draft will be necessary to finalize TLS configuration leaves once the ietf-tls-client-server-model that the NETCONF WG plans to spin out of the netconf-server-model draft is available.

Changes from feedback from Mahesh J:
- added support for configuring a syslog server

Changes from feedback from Tom P.:
- removed four features for log action leaves console, buffer, terminal and session since they are implemented by multiple vendors. Lack of support for these actions can be indicated using a deviation.
- removed feature buffer-limit-messages since implementation by any vendor is unknown
- renamed feature terminal-facility-user-logging-config to terminal-facility-device-logging to shorten the name and to clarify
- renamed feature session-facility-user-logging-config to session-facility-user-logging to shorten the name
- renamed feature selector-sevop-config to feature select-sev-compare to shorten the name
- renamed feature selector-match-config to feature select-match to shorten the name
- renamed feature structured-data-config to feature structured-data to shorten the name
- renamed feature signed-messages-config to feature signed-messages to shorten the name
- removed the log-buffer list and name from log-action buffer since implementation by any vendor is unknown
- removed the word draft from section 1
- updated the copyright dates and the revision dates in the models
- moved the example to an Appendix
- removed e-mail addresses from the acknowledgement section

Changes from feedback from Benoit:
- rename module vendor-syslog-types to module vendor-syslog-types-example

Thanks,

Kiran and Clyde

On 5/10/16, 2:14 PM, "netmod on behalf of [email-masked]" <[email-masked] on behalf of [email-masked]> wrote:

>_______________________________________________
>netmod mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/netmod

---

From: "Sterne, Jason (Nokia - CA)" <[email-masked]>
Date: Fri, 27 May 2016 19:30:43 +0000

Hi Clyde,

I was a bit surprised to see the receiver/server side config in here (log-input-transports).  That seems to be a somewhat significant change in scope.  I thought the focus of this was more on the generation & distribution.  Do many implementations have functionality that maps to this log-input-transports ?   In any case the pyang tree has log-input-transports but it doesn't seem to be down in the actual model itself.  But I'd be inclined to just remove this from the model.  Maybe Mahesh has some thoughts here (I didn't see a posting about this in the mailing list).

I agree there are multiple implementations of console, buffer and session logs.  But maybe 'terminal' should be removed or an if-feature ?  I'm not sure that one is so widespread (not in JUNOS, not in SR OS).

Buffer-limit-messages and having multiple log buffers are both supported by Nokia SR OS. I would think that both of those would have support in other logging implementations as well.  I'm not sure if Tom P. was really concluding that there are no implementations of these in his email.  Do we have multiple examples of implementations that limit log buffers using bytes ?

Buffer-limit-messages would be easy to do as an augmentation but making the log-buffer a list is probably something we should just do from the start.  That is also consistent with all the other types of actions (except console of course). The use case for multiple log buffers is that you might sort/filter different types of log events into different circular buffers (i.e. have one for really critical log events, etc) for viewing on the node.

Regards,
Jason

-----Original Message-----
From: netmod [mailto:[email-masked]] On Behalf Of EXT Clyde Wildes (cwildes)
Sent: Tuesday, May 10, 2016 17:23
To: [email-masked]
Subject: Re: [netmod] I-D Action: draft-ietf-netmod-syslog-model-08.txt

Hi,

Thanks,

Kiran and Clyde

On 5/10/16, 2:14 PM, "netmod on behalf of [email-masked]" <[email-masked] on behalf of [email-masked]> wrote:

>Please note that it may take a couple of minutes from the time of 
>submission until the htmlized version and diff are available at tools.ietf.org.
>

---

From: t.petch <[email-masked]>
Date: Sat, 28 May 2016 12:36:42 +0100

<inline briefly>
Tom Petch

----- Original Message -----
From: "Sterne, Jason (Nokia - CA)" <[email-masked]>
Sent: Friday, May 27, 2016 8:30 PM

> Hi Clyde,
>
> I was a bit surprised to see the receiver/server side config in here
(log-input-transports).  That seems to be a somewhat significant change
in scope.  I thought the focus of this was more on the generation &
distribution.  Do many implementations have functionality that maps to
this log-input-transports ?   In any case the pyang tree has
log-input-transports but it doesn't seem to be down in the actual model
itself.  But I'd be inclined to just remove this from the model.  Maybe
Mahesh has some thoughts here (I didn't see a posting about this in the
mailing list).
>
> I agree there are multiple implementations of console, buffer and
session logs.  But maybe 'terminal' should be removed or an if-feature ?
I'm not sure that one is so widespread (not in JUNOS, not in SR OS).
>
> Buffer-limit-messages and having multiple log buffers are both
supported by Nokia SR OS. I would think that both of those would have
support in other logging implementations as well.  I'm not sure if Tom
P. was really concluding that there are no implementations of these in
his email.  Do we have multiple examples of implementations that limit
log buffers using bytes ?

My comment was more on the complexity that results from having so many
options.  Other models are worse - some of the routing ones I find
unintelligible as a result - but I raised the issue on this model
because it is being discussed on this list where (almost) all the
expertise in these matters resides to see if anyone else would bite.

I believe we will regret this complexity some years down the line but
see no way of forestalling this:-(

I don't have direct knowledge of whether or not this feature is
widespread.

Tom Petch

> Buffer-limit-messages would be easy to do as an augmentation but
making the log-buffer a list is probably something we should just do
from the start.  That is also consistent with all the other types of
actions (except console of course). The use case for multiple log
buffers is that you might sort/filter different types of log events into
different circular buffers (i.e. have one for really critical log
events, etc) for viewing on the node.
> This update to the draft-ietf-netmod-syslog-model-08 incorporates the
changes listed below based on feedback received.
>
> An additional revision to this draft will be necessary to finalize TLS
configuration leaves once the ietf-tls-client-server-model that the
NETCONF WG plans to spin out of the netconf-server-model draft is
available.
> - removed four features for log action leaves console, buffer,
terminal and session since they are implemented by multiple vendors.
Lack of support for these actions can be indicated using a deviation.
> - renamed feature terminal-facility-user-logging-config to
terminal-facility-device-logging to shorten the name and to clarify
> - renamed feature session-facility-user-logging-config to
session-facility-user-logging to shorten the name
> On 5/10/16, 2:14 PM, "netmod on behalf of [email-masked]"

---

From: Mahesh Jethanandani <[email-masked]>
Date: Sat, 28 May 2016 15:57:07 -0700

> On May 10, 2016, at 2:22 PM, Clyde Wildes (cwildes) <[email-masked]> wrote:
> 
> Hi,
> 

Did I? Sorry, if there was a miscommunication. I thought the rational that networks devices are rarely configured as syslog servers made sense. I will let the WG decide if they want to keep syslog server configuration. 

We were discussing ssh server and client configuration and the desire to include that as part of the work (being done by Kent and others in NETCONF WG).

Cheers

Mahesh Jethanandani
[email-masked]

---

From: "Clyde Wildes (cwildes)" <[email-masked]>
Date: Tue, 31 May 2016 20:53:59 +0000

Jason,

With regards to adding log-input-transports: please see RFC 5424 – The Syslog Protocol, sections 3 and 4 where relay and collector functions are discussed. In order to support the relay and/or collector function, log-input-transports is required and I believe it is best to support the entire RFC 5424 protocol.

I produced the following table to help with the analysis of what features might be included. Please provide updates to the table to help with the analysis.

        Feature             Alcatel  Brocade  Ciena  Cisco IOS/XE  Cisco IOS/XR  Cisco NXOS  Juniper JunOS  Linux Rsyslog  Comments
log-input-transports                                                                                              x
log-action console             x        x                 x              x           x            x               x	
log-action buffer              x                          x              x
log-action file                x                          x              x           x            x               x
log-action remote                       x       x         x              x           x            x               x
log-action terminal                                       x              x           x                            x
log-action session             x                                                                  x
feature buffer-limit-bytes	 ?                          x              x
feature file-limit-size                                   x              x                        x
feature file-limit-duration                               x                                       x
feature 
 terminal-facility-device-logging
feature 
 session-facility-user-logging x                                                                  x
feature select-sev-compare     x                          x                                                       x
feature select-match           x                          x                                       x               x
feature structured-data                                                                           x               x     Required because of RFC 5424
feature signed-messages                                                                                           x     Required because of RFC 5848
									
Alcatel - https://infoproducts.alcatel-lucent.com/cgi-bin/dbaccessfilename.cgi/9300710702_V1_7750%20SR%20(SERVICE%20ROUTER).pdf
Ciena - https://www.commoncriteriaportal.org/files/epfiles/st_vid10460-st.pdf
Cisco IOS/XE - http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/command/esm-cr-book/esm-cr-a1.html
Cisco IOS/XR - http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/system_monitoring/command/reference/b-sysmon-cr-asr9k/b-sysmon-cr-asr9k_chapter_0100.html
Cisco NXOS - http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/system-management/command/reference/n7k_sm_cmd_ref/sm_cmd_l.html#pgfId-1014686
Brocade - http://www.brocade.com/content/html/en/command-reference-guide/nos-700-commandref/GUID-2297E4CA-76DC-43E5-9164-AC1AC9D3F4E7.html
Juniper JunOS - http://www.juniper.net/documentation/en_US/junos12.3/topics/reference/configuration-statement/syslog-edit-system.htm;
Linux Rsyslog - http://www.rsyslog.com/doc/v8-stable/									

Thanks,

Clyde