Subject: [Syslog-sec] SNMP parameters in syslog message (renamed subject)

From: "Rainer Gerhards" <[email-masked]>
Date: Fri, 8 Apr 2005 11:24:04 +0200

Hi all,

I have added the sequenceID and sysUpTime to the draft:

####
7.3  meta

   The SD-ID "meta" MAY be used to provide meta-information about the
   message.  The following parameters can be used.  All parameters are
   optional.  If the "meta" SD-ID is used, at least one parameter SHOULD
   be specified.

7.3.1  sequenceID

   The "sequenceID" parameter allows to track the sequence in which the
   sender sent the messages.  It is an integer that MUST be reset to 0
   at reboot and MUST be monotnically incremented with each message
   sent.  Its maximum value is 4,294,967,295.  If that value is reached,
   the next message must be emited with a sequenceID of 0.

7.3.2  sysUpTime

   The "sysUpTime" parameter MAY be used to include the SNMP "sysUpTime"
   parameter in the message.  Its syntax and semantics are as defined in
   RFC 3418 [12].
####

While I did this, I got an idea that I would like to ask for feedback
on. Would't it be a good idea to define an "snmp" SD-ID? As parameters,
it could contain any MIB value that a vendor sees fit. Probably this
would be a good umbrella for all sorts of things. We could also move the
software identification from the origin SD-ID over to this one.

I am sure there are a number of subleties if we do this. I would
especially appreciate if those familiar with SNMP could comment and
eventually provide a text suggestion (if they like the idea).

Thanks,
Rainer 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> David B Harrington
> Sent: Thursday, April 07, 2005 10:15 PM
> To: 'Tom Petch'; 'syslog'
> Subject: RE: [Syslog-sec] Detailed Review Comments on Syslog 
> Protocol -09-Part III
> 
> Hi,
> 
> Please note that the starting epoch for SysUpTime is the
> reinitialization of the network management system (e.g. the SNMP
> agent). This may be different than "boot" which typically refers to
> reinitialization of the hardware device. Granularity is in hundredths,
> not thousandths of a second.
> 
> If you want the amount of time in TimeTicks since the device was last
> initialized, you might consider hrSystemUptime from the Host Resources
> MIB [RFC 2790].
> 
> > > ><snip>
> > > > As far as sysUptime is concerned, I think we should stick 
> > with the SNMP
> > > > definition of the number of milliseconds since boot, with 
> > a max value of
> > > > 4294967295 and automatic reset to zero thereafter. Is 
> > this understanding
> > > > correct?
> > > >
> > > I think not;  [RFC 3418] defines sysUpTime as having a 
> > SYNTAX of TimeTicks and
> > > [RFC 2578] defines TimeTicks as
> > >   "...represents a non-negative integer which represents
> > >    the time, modulo 2^32 (4294967296 decimal), in 
> > hundredths of a second
> > >    between two epochs."
> 
> David Harrington
> [email-masked]
> co-chair IETF SNMPv3 WG, concluded
> 
> 
> _______________________________________________
> Syslog-sec mailing list
> [email-masked]
> http://www.employees.org/mailman/listinfo/syslog-sec
> 
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: "Tom Petch" <[email-masked]>
Date: Mon, 11 Apr 2005 22:14:49 +0200

<inline>
Tom Petch

----- Original Message -----
From: "Rainer Gerhards" <[email-masked]>
To: <[email-masked]>
Sent: Friday, April 08, 2005 11:24 AM
Subject: [Syslog-sec] SNMP parameters in syslog message (renamed subject)

<snip>
7.3.1  sequenceID

Uh huh. Everywhere, I look monotonic has the same, well-defined meaning which is
that the value only changes in one direction.  So
99 77 23 5 5 5 3 3 1 -1
is a monotonic sequence as is
1 1 1 2 2 3 3 3 5 7 68 79 123
To quote Merriam-Webster,
" having the property either of never increasing or of never decreasing as the
values of the independent variable or the subscripts of the terms increase
<monotonic functions> <a monotonic sequence>"

Some words change their meaning as they travel around the world but I do not
think this is one of them:-)

If you want each value to be greater than (not greater than or equal to) the
previous one, then I
think you want 'strictly increasing' but I would suggest instead
'It is an integer that MUST be set to 0 when the syslog function is started and
MUST be increased with every message up to a maximum value of 4,294,967,295.  If
that value is reached, the next message must be sent with a sequenceID of 0.'

But I also question the use of zero; zero is special, best avoided unless really
wanted (as in SNMP index values and enumerations) so I suggest starting at one.

And I would prefer sequenceId to sequenceID (perhaps because I use so much
Snmp:-)