Subject: [Syslog] New -protocol document - your comments needed by 25 June

From: Chris Lonvick <[email-masked]>
Date: Wed, 13 Jun 2007 07:55:56 -0700 (PDT)

Hi Folks,

I'm going to ask that people review the new -protocol document.
   http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-21.txt

I'd like to get that back to Sam by the 25th.  I'm not sure that this will 
need another IETF Last Call but I'll discuss that with Sam.

I want to be clear, the comments I'm looking for are those about the 
changes made to the document from the last IETF Last Call.  The vast 
majority of the normative sections of the document have been accepted by 
the WG and by the IETF.  We will not be making any changes to those 
sections.

Thanks,
Chris

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "tom.petch" <[email-masked]>
Date: Thu, 14 Jun 2007 17:35:58 +0200

Um

The three syslog layer definitions look good to me, but the five that come after
do not seem quite to fit

'   o  An "originator" generates syslog content to be carried in a
      message.

   o  A "collector" gathers syslog content for further analysis.'

>From the earlier definition, I think the syslog application layer receives
syslog content and generates syslog message, as opposed to generating syslog
content.

'   o  A "transport sender" passes syslog messages to a specific
      transport protocol

   o  A "transport receiver" takes syslog messages from a specific
      transport protocol.'

Again, from the earlier definition of putting messages on the wire, I think that
sender and receiver pass to and take from the wire using a specific protocol.

Tom Petch

---

From: "David Harrington" <[email-masked]>
Date: Fri, 15 Jun 2007 08:20:26 -0400

Hi,

Would it be helpful to identify where in the architecture the
"facility" exists? I think some people think the originator is the
thing that asks syslog to send a message (is that the facility?),
while others think the syslog thing that creates the syslog message
(e.g. syslogd) is the originator.

dbh

> -----Original Message-----
> From: tom.petch [mailto:[email-masked]] 
> Sent: Thursday, June 14, 2007 11:36 AM
> To: Chris Lonvick; syslog
> Subject: Re: [Syslog] New -protocol document - your comments 
> needed by 25 June
> 
> Um
>

---

From: "Rainer Gerhards" <[email-masked]>
Date: Fri, 15 Jun 2007 18:27:00 +0200

David,

I am not sure if I get you.

Facility is "just" a header field, most often used for filtering on the
collector or relay.

A standard syslog.conf might have

mail.* /var/log/mail.log
syslog.* /var/log/syslog.log

which means that all messages with mail facility are put in the mail.log
bin while those with syslog facility are put in the other bin.

The originator assigns the facility and a realy eventually rewrites it.

Does that help?

Rainer

> From: David Harrington [mailto:[email-masked]]
> Sent: Friday, June 15, 2007 2:20 PM
> To: 'tom.petch'; 'Chris Lonvick'; 'syslog'
> Subject: RE: [Syslog] New -protocol document - your comments needed by
> 25 June
> 
> Hi,
>

---

From: "tom.petch" <[email-masked]>
Date: Mon, 18 Jun 2007 10:45:56 +0200

----- Original Message -----
From: "David Harrington" <[email-masked]>
To: "'tom.petch'" <[email-masked]>; "'Chris Lonvick'"
<[email-masked]>; "'syslog'" <[email-masked]>
Sent: Friday, June 15, 2007 2:20 PM
Subject: RE: [Syslog] New -protocol document - your comments needed by 25 June

> (e.g. syslogd) is the originator.

Not sure if that would help.  My concern is what I see as inconsistency between
definitions, either of which would do but for the other e.g.

   o  "syslog content" is the management information contained in a
      syslog message.

coupled with

   o  An "originator" generates syslog content to be carried in a
      message.

and

 |---------------------|    |---------------------|
 |  syslog application |    |  syslog application | (originator,
 |                     |    |                     |  collector, relay)
 |---------------------|    |---------------------|

leaves me confused; is generating content the role of the top layer or the
middle layer?

Had we service interfaces (and no, we should not be putting these into the I-D)
then I would have (ABNF) MSG passing from content layer to application layer
with application adding HEADER SP STRUCTURED-DATA before passing SYSLOG-MSG to
trasnport which does the rest: but I cannot square that with the definitions of
originator, collector, transport sender, transport receiver.

Tom Petch