Subject: [Syslog] FW: draft-ietf-syslog-protocol: "Reliable delivery consideredharmful."

From: "David Harrington" <[email-masked]>
Date: Wed, 7 Feb 2007 13:01:02 -0500

Forwarded from [email-masked]; please [email-masked] in any responses.

dbh

-----Original Message-----
From: David W. Hankins [mailto:[email-masked]] 
Sent: Thursday, February 01, 2007 5:32 PM
To: [email-masked]
Subject: Re: draft-ietf-syslog-protocol: "Reliable delivery
consideredharmful."

On Thu, Feb 01, 2007 at 10:30:17PM +0200, Pekka Savola wrote:
> It's acceptable for the syslog sender to replace overflowing lines
of 
> syslog (if some messages need to be dropped due to lack of
resources) 
> with a message about rate-limiting, messages being dropped, or 
> whatever -- just the same way as messages might get dropped when 
> syslogging to a local media.

Then the word that should be used here is not "reliable" without
any exceptions tagged on.

> As long as a) there is a message about syslogs getting dropped, and
b) 
> this is infrequent in a well operated system (i.e. the system log 
> levels are set so that typically the amount of logging is OK), this 
> should be no problem.

I should note that while this would be just fine, this is not in
fact what presently deployed syslog implementations that implement
"reliable" delivery (wether to network sockets or local files) do.

Today they block.

To use the world 'reliable' without illuminating clearly that
exceptions must be made is dangerous.

> IMHO, "reliable delivery of syslog output is always harmful" is very

> much an over-statement.

Well, I wasn't counting on shifting the definition of "reliable" to
"somewhat reliable".

Sure, "somewhat reliable delivery of syslog output is always harmful"
is very much an over-statement, I'll agree with that.

But I stand by what I said.

> get even more syslog to send. While this is a serious problem when
it 
> occurs, it should be easily solvable: just drop the messages (with a

> suitable note in syslog or in the local log) that exceed the buffer 
> size or prune messages from the buffer using some more advanced 
> strategy.

That would be fine.

But again, this is not what current implementations do, and that
is not "reliable" without exception.

-- 
David W. Hankins	"If you don't do it right the first time,
Software Engineer		you'll just have to do it again."
Internet Systems Consortium, Inc.	-- Jack T. Hankins
_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "David Harrington" <[email-masked]>
Date: Wed, 7 Feb 2007 13:01:02 -0500

Forwraded from [email-masked]; please include [email-masked] in
responses.

dbh

-----Original Message-----
From: Stephane Bortzmeyer [mailto:[email-masked]] 
Sent: Friday, February 02, 2007 2:32 AM
To: David W. Hankins
Cc: [email-masked]
Subject: Re: draft-ietf-syslog-protocol: "Reliable delivery
consideredharmful."

On Thu, Feb 01, 2007 at 10:08:39AM -0800,
 David W. Hankins <[email-masked]> wrote 
 a message of 98 lines which said:

> If you block, that's a big problem as it ultimatley totally disables
> the service attempting to log information.

Wether it is a bug or a feature depends on your requirments. On some
high-security environments, people prefer to suspend the service
rather than not being able to log it. (Otherwise, an attacker could
easily attempt many attacks, fill in the hard disk and then perform
the real attack unlogged).

> reliable delivery of syslog output is always harmful.

Clearly, "always" is too much.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: "David Harrington" <[email-masked]>
Date: Wed, 7 Feb 2007 13:01:02 -0500

dbh

-----Original Message-----
From: David W. Hankins [mailto:[email-masked]] 
Sent: Thursday, February 01, 2007 5:32 PM
To: [email-masked]
Subject: Re: draft-ietf-syslog-protocol: "Reliable delivery
consideredharmful."

of 
resources) 

b) 

Today they block.

it 

That would be fine.

---

From: "David Harrington" <[email-masked]>
Date: Wed, 7 Feb 2007 13:01:02 -0500

dbh

-----Original Message-----
From: Stephane Bortzmeyer [mailto:[email-masked]] 
Sent: Friday, February 02, 2007 2:32 AM
To: David W. Hankins
Cc: [email-masked]
Subject: Re: draft-ietf-syslog-protocol: "Reliable delivery
consideredharmful."

---

From: "David Harrington" <[email-masked]>
Date: Wed, 7 Feb 2007 13:06:19 -0500

Forwarded from [email-masked]; please include [email-masked] in any
responses.

dbh

-----Original Message-----
From: Eliot Lear [mailto:[email-masked]] 
Sent: Friday, February 02, 2007 9:04 AM
To: Pekka Savola
Cc: [email-masked]
Subject: Re: draft-ietf-syslog-protocol: "Reliable delivery
consideredharmful."

I'd have to agree with Pekka.  We've just gone through this with ATIS 
and "reliable" accounting, which is quite a bit messier than this 
problem.  So long as the log indicates that something bad has
happened, 
it seems to me that you're covered.  Of course, with reliability comes

some amount of complexity.  If an implementation detects the problem, 
say, through the other side not ACKing data, it's probably a good idea

to switch to one's backup log server, right?  I know of no syslogger 
that behaves in this manner today, although perhaps there are some out

there.  That doesn't mean we should not provide the function.

Finally, it seems to me we are all arguing over non-normative text.  
Choice of level of reliability is generally a deployment concern.

Eliot

---

From: "David Harrington" <[email-masked]>
Date: Wed, 7 Feb 2007 13:16:43 -0500

dbh 

-----Original Message-----
From: Stephane Bortzmeyer [mailto:[email-masked]] 
Sent: Monday, February 05, 2007 5:33 AM
To: David W. Hankins
Cc: [email-masked]
Subject: Re: draft-ietf-syslog-protocol: "Reliable delivery
consideredharmful."

On Fri, Feb 02, 2007 at 09:59:45AM -0800,
 David W. Hankins <[email-masked]> wrote 
 a message of 60 lines which said:

> I'd just like to point out that you're choosing one bug over
> another.

Not at all (a disk which is full is *not* a bug). I simply want to
emphasize that security is ALWAYS a compromise. And that the draft
should explain this compromise so the system administrator may make an
informed choice. (The text proposed by Harald seems OK.)

---

From: "David Harrington" <[email-masked]>
Date: Wed, 7 Feb 2007 13:16:43 -0500

dbh

-----Original Message-----
From: David W. Hankins [mailto:[email-masked]] 
Sent: Friday, February 02, 2007 1:00 PM
To: [email-masked]
Subject: Re: draft-ietf-syslog-protocol: "Reliable delivery
consideredharmful."

I'd just like to point out that you're choosing one bug over
another.  A DOS in preference to lack of observance of events.

In my opinion, that's a bad selection, but it's your selection to
make.

That kind of preference, that kind of choice, is a good thing to
have, but it would be unwise to apply to the general case a
systematic selection of DOS over observation.

---

From: "David Harrington" <[email-masked]>
Date: Wed, 7 Feb 2007 13:16:43 -0500

dbh

-----Original Message-----
From: Stephane Bortzmeyer [mailto:[email-masked]] 
Sent: Monday, February 05, 2007 5:33 AM
To: David W. Hankins
Cc: [email-masked]
Subject: Re: draft-ietf-syslog-protocol: "Reliable delivery
consideredharmful."