Subject: [netmod] I-D Action: draft-ietf-netmod-syslog-model-10.txt

From: [email-masked]
Date: Mon, 31 Oct 2016 13:20:44 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the NETCONF Data Modeling Language of the IETF.

        Title           : A YANG Data Model for Syslog Configuration
        Authors         : Clyde Wildes
                          Kiran Koushik
	Filename        : draft-ietf-netmod-syslog-model-10.txt
	Pages           : 33
	Date            : 2016-10-31

Abstract:
   This document describes a data model for the configuration of syslog.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-netmod-syslog-model/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-netmod-syslog-model-10

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-netmod-syslog-model-10

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Phil Shafer <[email-masked]>
Date: Mon, 31 Oct 2016 20:45:06 -0400

>        Title           : A YANG Data Model for Syslog Configuration

I've a few questions:

- The description says that the "facility/no-facility" case/leaf
is used "o effectively disable a particular log-action".  Why not
make an explicit "disable" leaf instead?  Using no-facilities like
this is confusing.

- Why use an explicit/mandatory selector node instead of making
this implicit, with the lack of a selector meaning match all?

- compare-op: we've always tried to use full words; would this be
better as "compare-operation" or just "compare"?

- equals-or-higher: you might want to explain that this is the
default even in the absence of the "select-sev-compare" feature.
(I'm assuming this is true.)

- You use "facility" as both a case and a list under selector-facility.
This seems confusing and misleading.

- "structured-data": says "describes how log messages are written
to the log file" but it applies to more than log files.

- Consider making "syslog-sign" into "signing-options" or something
similar, to be more clear.  The "syslog-" prefix is not needed,
since the reader knows we are talking about syslog, and the "sign"
is not clear.  Then you can remove the "sig-" prefix on the child
nodes.

- The "session" name is not clear, since there are many sort of
sessions; would "local-users" be better?

- What purpose for the "actions" container serve?  Can it be removed?

- "buffer" should be a feature, since many platforms do not implement it.

- How does an implementation specify the set of valid characters usable
for user names?

- Many networking devices have special tags at the front of their
messages, indicating the specific message.  For example "%ASA-1-104001"
in IOS, or "BGP_CEASE_PREFIX_LIMIT_EXCEEDED" in JUNOS.  We carry
these are specific SD-PARAMS when SD is used.  Is there a way to
filter using theses tags, or more generic SD-PARAMS?

Thanks,
 Phil