Subject: RE: [Syslog-sec] SNMP parameters in syslog message - sequenceId

From: "Rainer Gerhards" <[email-masked]>
Date: Thu, 14 Apr 2005 17:27:00 +0200

Tom,

thanks for the reply and the text suggestion. Changed it according to
your suggested text which exactly described what I wanted to suggest ;)
As a thanks, I've also change the ID to "sequenceId" - if others
complain, I can change it back. I've now reserved 0 for special cases,
which means the rollover is also to 1 and not to 0.

The text now reads as follows:

####
7.3.1  sequenceId

   The "sequenceId" parameter allows to track the sequence in which the
   sender sent the messages.  It is an integer that MUST be set to 1
   when the syslog function is started	and MUST be increased with every
   message up to a maximum value of 4,294,967,295.  If that value is
   reached, the next message must be sent with a sequenceId of 1.
####

Rainer 

> -----Original Message-----
> From: Tom Petch [mailto:[email-masked]] 
> Sent: Monday, April 11, 2005 10:15 PM
> To: Rainer Gerhards; syslog
> Subject: Re: [Syslog-sec] SNMP parameters in syslog message - 
> sequenceId
> 
> <inline>
> Tom Petch
> 
> ----- Original Message -----
> From: "Rainer Gerhards" <[email-masked]>
> To: <[email-masked]>
> Sent: Friday, April 08, 2005 11:24 AM
> Subject: [Syslog-sec] SNMP parameters in syslog message 
> (renamed subject)
> 
> 
> <snip>
> 7.3.1  sequenceID
> 
>    The "sequenceID" parameter allows to track the sequence in 
> which the
>    sender sent the messages.  It is an integer that MUST be reset to 0
>    at reboot and MUST be monotnically incremented with each message
>    sent.  Its maximum value is 4,294,967,295.  If that value 
> is reached,
>    the next message must be emited with a sequenceID of 0.
> 
> Uh huh. Everywhere, I look monotonic has the same, 
> well-defined meaning which is
> that the value only changes in one direction.  So
> 99 77 23 5 5 5 3 3 1 -1
> is a monotonic sequence as is
> 1 1 1 2 2 3 3 3 5 7 68 79 123
> To quote Merriam-Webster,
> " having the property either of never increasing or of never 
> decreasing as the
> values of the independent variable or the subscripts of the 
> terms increase
> <monotonic functions> <a monotonic sequence>"
> 
> Some words change their meaning as they travel around the 
> world but I do not
> think this is one of them:-)
> 
> If you want each value to be greater than (not greater than 
> or equal to) the
> previous one, then I
> think you want 'strictly increasing' but I would suggest instead
> 'It is an integer that MUST be set to 0 when the syslog 
> function is started and
> MUST be increased with every message up to a maximum value of 
> 4,294,967,295.  If
> that value is reached, the next message must be sent with a 
> sequenceID of 0.'
> 
> But I also question the use of zero; zero is special, best 
> avoided unless really
> wanted (as in SNMP index values and enumerations) so I 
> suggest starting at one.
> 
> And I would prefer sequenceId to sequenceID (perhaps because 
> I use so much
> Snmp:-)
> 
> 
> 
> 
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 14 Apr 2005 11:49:46 -0400

Hi,

I'm going to disagree that this should start at and rollover to 1
"because that's the way SNMP does it". 
The RFC2578 SMIv2 recommendation of starting at 1 rather than 0 is for
enumerations, not message identifiers.

The SNMP request-id does not start at 1, and roll over to 1.
>From RFC3416:
  PDU ::= SEQUENCE {
           request-id INTEGER (-214783648..214783647),

[the range used is due to the fact that the ASN.1 INTEGER type is a
32-bit signed value, not unsigned. If syslog uses unsigned encoding,
the 0..4294967295 range is fine.]

David Harrington
[email-masked]
co-chair IETF SNMPv3 WG, concluded

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> Rainer Gerhards
> Sent: Thursday, April 14, 2005 11:27 AM
> To: [email-masked]
> Subject: RE: [Syslog-sec] SNMP parameters in syslog message - 
> sequenceId
> 
> Tom,
>

---

From: "Tom Petch" <[email-masked]>
Date: Thu, 14 Apr 2005 18:18:38 +0200

I still see zero as best avoided since in many places (but by no means all) it
carries overtones of this does not exist, has not been set to a valid value, is
an escape etc etc.

If the range is -214783648..214783647, then I agree, zero might as well be
included but by the same token, I would avoid negative numbers unless there is a
strong case for them (which I do not see).

I see the flavour of syslog as being user friendly, easy to read (hence the use
of ASCII) and so avoiding negative numbers and zero fits in with that.  I see
SNMPv3 and its use of sequence numbers as ..... magnificently different? and not
always the paradigm to follow.

Tom Petch