Subject: [Syslog-sec] protocol-11.txt - sysUpTime

From: "David B Harrington" <[email-masked]>
Date: Thu, 21 Apr 2005 13:51:07 -0400

Hi,

You state that semantics and syntax are as defined in RFC 3418, then
proceed to define a different syntax. It is a bad practice to claim
consistency with something, and then reinvent it but keep calling it
the same thing. We should decide what we want here.

If the goal is consistency with SNMP, then we should use the syntax
used for the SNMPv2-MIB sysUpTime [RFC 3418]. That syntax is a
TimeTicks value (INTEGER 0..4294967295 hundredths of a second, with no
decimal points) since reinitialization of the (SNMP) management
system. 

If the goal is to define a syslog-specific version of sysUpTime, then
we should skip the reference to RFC 3418, call it something else, and
define it fully as a syslog field. If we go this route, then we should
discuss what re-initialization of the management system means - is
this re-initialization of the SNMP management system, or is it the
re-initialization of (a particular part of) the syslog system? We
might also want to document rollover behavior.

David Harrington
[email-masked]

> ####
> 7.3.2  sysUpTime
> 
>    The "sysUpTime" parameter MAY be used to include the SNMP 
> "sysUpTime"
>    parameter in the message.  Its syntax and semantics are as 
> defined in
>    RFC 3418 [12].
> 
>    In syslog, it is represented as a decimal string with a maximum
of
>    two digits for fractional seconds.  Full seconds and fractional
>    seconds MUST be delimited by a period (".").  Leading 
> zeros MUST NOT
>    be used for full seconds.  For example, a "sysUpTime" of one
minute
>    MAY be represented as "60", "60.0", or "60.00", but not as "060"
or
>    "60.000".
> ####
> 
> I am not so proficient with SNMP, but I think (as you said) 
> TimeTicks is
> actually integer. So we should have a maximum value defined plus a
> rollover behaviour. Or does this mean we also need to include 
> an epoch?
> ;)
> 
> Rainer
> _______________________________________________
> Syslog-sec mailing list
> [email-masked]
> http://www.employees.org/mailman/listinfo/syslog-sec
> 

_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: "Rainer Gerhards" <[email-masked]>
Date: Thu, 21 Apr 2005 18:47:32 +0200

Tom,

thanks for your suggestions. Comments below...

> I would like the section on SD-ID to be more precise on 
> acceptable formats.
> 
> enterpriseID (enterpriseId? p.41 does say 'This document uses 
> "camel case"
> consistently' ) allows multiple sub-identifiers but does not
> specify a textual representation or a separator.  I assume 
> decimal number and
> period, eg
> "9.1.30"
> "11.2.3.7.5.12"
> but think this should be spelt out

changed as follows:

####
7.2.2  enterpriseId

   The "enterpriseId" parameter MUST be a 'SMI Network Management
   Private Enterprise Code', maintained by IANA, whose prefix is
   iso.org.dod.internet.private.enterprise (1.3.6.1.4.1).  The number
   that follows is unique and may be registered by an on-line form at
   <http://www.iana.org/>.  Only that number and any-enterprise assigned
   ID below it MUST be specified in the "enterpriseId" parameter.  If
   sub-identifiers are used, they MUST be separated by periods and be
   represented as decimal numbers ("9.1.30" and "11.2.3.7.5.12").  The
   complete up-to-date list of Enterprise Numbers is maintained by IANA
   at <http://www.iana.org/assignments/enterprise-numbers>.

   By specifying an enterpriseId, the vendor allows more specific
   parsing of the message.
####

> 
> sysUpTime again I would like specifying.  I do not think the 
> reference to
> RFC3418 enough especially as there, the syntax is TimeTicks 
> ie integer:-).  And
> since it is in hundredths of a second, is one minute 
> represented as "6000 or
> "60.00 or ...?  I assume the first is meant ie decimal 
> representation of an
> integer (which, after six months running, would be 1 576 800 
> 000 ... mmm).

I have changed the text:

####
7.3.2  sysUpTime

   The "sysUpTime" parameter MAY be used to include the SNMP "sysUpTime"
   parameter in the message.  Its syntax and semantics are as defined in
   RFC 3418 [12].

   In syslog, it is represented as a decimal string with a maximum of
   two digits for fractional seconds.  Full seconds and fractional
   seconds MUST be delimited by a period (".").  Leading zeros MUST NOT
   be used for full seconds.  For example, a "sysUpTime" of one minute
   MAY be represented as "60", "60.0", or "60.00", but not as "060" or
   "60.000".
####

I am not so proficient with SNMP, but I think (as you said) TimeTicks is
actually integer. So we should have a maximum value defined plus a
rollover behaviour. Or does this mean we also need to include an epoch?
;)

Rainer

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 21 Apr 2005 13:23:48 -0400

Hi,

Some comments inline

>    iso.org.dod.internet.private.enterprise (1.3.6.1.4.1).  

Does this mean that when carried in a message, the "1.3.6.1.4.1" must
be included? This really isn't necessary. This is where the enterprise
ID is rooted in the IANA naming tree, but the enterprise ID is really
only the seventh octet, which contains the non-negative integer value
assigned by IANA.

>    The number
>    ID below it MUST be specified in the "enterpriseId" parameter.  

> If
>    represented as decimal numbers ("9.1.30" and "11.2.3.7.5.12"). 

There are no subidentifiers in an enterprise ID. An enterprise ID is
always a single non-negative integer in the range 0..4294967295, as
assigned by IANA.

>  The

This field should only contain a single non-negative integer value as
assigned by IANA. 

I propose the following replacement text:
####
7.2.2  enterpriseId

   The "enterpriseId" parameter MUST be a 'SMI Network Management
Private Enterprise     
   Code', assigned by the Internet Assigned Numbers Authority (IANA). 

   The number is assigned to register an enterprise within the
internet subtree of 
   the ISO/ITU identification scheme. Requests for enterprise IDs may
be submitted 
   using an on-line form at <http://www.iana.org/>. The complete
up-to-date list of   
   Enterprise Numbers is maintained by IANA at 
   <http://www.iana.org/assignments/enterprise-numbers>.

####