Subject: [netmod] example in draft-ietf-netmod-syslog-model-04

From: Ladislav Lhotka <[email-masked]>
Date: Tue, 14 Jul 2015 15:57:14 +0200

Hi,

the example in sec. 4.3 of draft-ietf-netmod-syslog-model-04 is
invalid: the value of "severity" should be "critical" rather than
"syslogtypes:critical". Enums are simple strings, not QNames.

Also, I wonder why the type of "severity" is defined (in multiple
places) like so:

      type union {
        type syslogtypes:severity;
        type enumeration {
          enum all {
            value -1;
            description
              "This enum describes the case where all severities 
               are requested.";
          }
        }

I think the "all" enum can be simply added to the "syslogtypes:severity"
enumeration.

Lada

-- 
Ladislav Lhotka, CZ.NIC Labs
PGP Key ID: E74E8C0C

---

From: "Clyde Wildes (cwildes)" <[email-masked]>
Date: Tue, 14 Jul 2015 15:25:29 +0000

Lada,

Thanks for your review.

All was not added to the syslogtypes:severity because that would alter the definition of severity as specified by RFC 5424 in Table 2 on page 10. I agree that it will simplify the model to do so.

Please advise.

Thanks,

Clyde

On 7/14/15, 6:57 AM, "netmod on behalf of Ladislav Lhotka" <[email-masked] on behalf of [email-masked]> wrote:

>_______________________________________________
>netmod mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/netmod

---

From: Ladislav Lhotka <[email-masked]>
Date: Tue, 14 Jul 2015 18:03:46 +0200

> On 14 Jul 2015, at 17:25, Clyde Wildes (cwildes) <[email-masked]> wrote:
> 
> Lada,
> 
> Thanks for your review.
> 

The description of the “severity” leaf says:

When severity is specified the default severity comparison is all messages of the specified severity and greater are logged unless all is specified which means all severities are requested.

Isn’t then “debug” equivalent to “all”, i.e. is the “all” option really needed?

> Please advise.

I would do a similar thing that you did for facilities: choice between “severity” (with the type “syslogtypes:severity”) and an empty leaf "all-severities”.

Lada

---

From: "Clyde Wildes (cwildes)" <[email-masked]>
Date: Tue, 14 Jul 2015 17:21:03 +0000

Lada,

I would prefer a specification that declares the "all" intent instead of relying on "debug" meaning all messages. A number syslog implementations specify a severity of "all". Example: rsyslog - http://www.rsyslog.com/doc/v8-stable/configuration/filters.html.

I used the union approach because, in an earlier review, Jan Lindblad suggested it as a simple method to add all without compromising the RFC definition of Severity. His point was that adding a choice is a complication.

Thanks,

Clyde

---

From: Ladislav Lhotka <[email-masked]>
Date: Tue, 14 Jul 2015 20:12:37 +0200

> On 14 Jul 2015, at 19:21, Clyde Wildes (cwildes) <[email-masked]> wrote:
> 
> Lada,
> 

OK, I just expressed my opinion. I also note that RFC 5424 says: "Facility and Severity values are not normative but often used.  They are described in the following tables for purely informational purposes.” So I wonder whether you really compromise anything by adding the “all” option.

Lada