Subject: Re: [netmod] New Version Notification for draft-ietf-netmod-syslog-model-03.txt

From: "Clyde Wildes (cwildes)" <[email-masked]>
Date: Wed, 11 Mar 2015 12:37:22 +0000

Hi,

During the IETF 91-Hawaii Netmod Syslog presentation given by Kiran Agrahara Sreenivasa we received these questions:

Q1: Why don't we have "logging buffered"?
A:  This was only in two of the five operating systems that we considered. We will add it as a feature.

Q2: Why isn't "logging file" a list?
A:  It should be and we will make that change.

Q3: Can we add "port" to logging file?
A:  Yes.

Q4: What does the logging match processing search? Does it search structured data?
A:  It searches the RFC 5424 SYSLOG-MSG field. We will clarify the description for the pattern-match field. Regular expression patterns can be developed to search specific structured data fields in the SYSLOG-MSG field.

Q5: Can the remote-logging-action support structured data?
A:  We will add the ability to send log messages in structured data format to remote servers.

The following changes have been made to the proposed draft-ietf-netmod-syslog-model RFC to address this feedback:

1. The addition of "buffered-logging-action" for logging to memory. In addition to the syslog-selector there is a buffer-size field. This addresses Q1 above.
2. The file-logging-action has been modified to be a list. This addresses Q2 above.
3. A destination-port field has been added to remote-logging-action with a default value of 514. This addresses Q3 above.
4. The description for logging-match-processing has been updated to indicate that the RFC 5424 SYSLOG-MSG field will be searched for a pattern match. This addresses Q4 above. Users are free to construct regex expressions that match on structured-data tags if needed.
5. A new feature and boolean have been added to remote-logging-action to support distribution of messages in structured-data format. This addresses Q5 above.

A review by Jan Lindblad, YANG Dr. from tail-f Systems, resulted in the follow changes:
- simplify the syslog-selector grouping
- add defaults where necessary
- add and remove mandatory fields where necessary
- improve description fields
- use the IETF lower case naming convention.

Thanks,

Clyde & Kiran

---

From: "Thomas D. Nadeau" <[email-masked]>
Date: Wed, 11 Mar 2015 08:55:49 -0400

WG please review and comment on the updated draft ASAP. If there are an pressing issues we can discuss on the list or in person in Dallas. 
Given that we are so close to the meeting now, we will begin a WG LC on the draft the Monday after the Dallas meeting.

	--Tom

> On Mar 11, 2015:8:37 AM, at 8:37 AM, Clyde Wildes (cwildes) <[email-masked]> wrote:
> 
> Hi,
> 
> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod
>