Subject: Fw: [Syslog-sec] Detailed Review Comments on Syslog Protocol -09 - Part III

From: "Tom Petch" <[email-masked]>
Date: Thu, 7 Apr 2005 18:14:34 +0200

Trying to post this - attempt 2.

Tom Petch

----- Original Message -----
From: "Tom Petch" <[email-masked]>
To: "Sharon Chisholm" <[email-masked]>
Sent: Thursday, April 07, 2005 3:16 PM
Subject: Re: [Syslog-sec] Detailed Review Comments on Syslog Protocol -09 - Part
III

> <inline>
> Tom Petch
>
> ----- Original Message -----
> From: "Sharon Chisholm" <[email-masked]>
> To: <[email-masked]>
> Sent: Friday, March 18, 2005 9:40 PM
> Subject: RE: [Syslog-sec] Detailed Review Comments on Syslog Protocol -09 -
Part
> III
>
> ><snip>
> > As far as sysUptime is concerned, I think we should stick with the SNMP
> > definition of the number of milliseconds since boot, with a max value of
> > 4294967295 and automatic reset to zero thereafter. Is this understanding
> > correct?
> >
> I think not;  [RFC 3418] defines sysUpTime as having a SYNTAX of TimeTicks and
> [RFC 2578] defines TimeTicks as
>   "...represents a non-negative integer which represents
>    the time, modulo 2^32 (4294967296 decimal), in hundredths of a second
>    between two epochs."
>
> <snip>
> > If Enterprise is equal to ACME and ACME makes two products: 1) rocket
> > powered roller blades and 2) electronic roadrunner traps, is this field
> > identifying 'acme' in both cases or is it acme.rocket or acme.trap depending
> > on the product? Keep in mind that both products run some of the same
> > software and some software unique to their own unique applications.>
>
> In SNMP, I usually see Enterprise ID followed by several other sub-identifiers
> which identify the (router) model, level of software etc as in
> 1.3.6.1.4.1.company.model.software etc etc
> There is really little constraint on how detailed an enterprise makes its
branch
> and many go to town.  Nice - as long as I can find the details somewhere on
the
> company website - but probably too long to include here.
> <snip>
>

_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 7 Apr 2005 16:15:29 -0400

Hi,

Please note that the starting epoch for SysUpTime is the
reinitialization of the network management system (e.g. the SNMP
agent). This may be different than "boot" which typically refers to
reinitialization of the hardware device. Granularity is in hundredths,
not thousandths of a second.

If you want the amount of time in TimeTicks since the device was last
initialized, you might consider hrSystemUptime from the Host Resources
MIB [RFC 2790].

> >    the time, modulo 2^32 (4294967296 decimal), in 

David Harrington
[email-masked]
co-chair IETF SNMPv3 WG, concluded