Subject: Re: [netmod] syslog-model-05: terminal logging vs session logging

From: "Clyde Wildes (cwildes)" <[email-masked]>
Date: Tue, 3 Nov 2015 23:05:55 +0000

Jason,

As always, thanks for your feedback!

I am consolidating your two sets of comments into one reply with my responses as [clw]:

[js] I’m not sure it is typical to have configuration in a device that basically instructs the device to enable logging to the terminal for “user x” whenever that user later logs in (and if they had multiple login sessions then presumably log events would be delivered to each session).

[js] Isn’t logging to a terminal more typically enabled on a CLI *session* basis rather than configured against a particular user ?

[clw] There are two concepts: logging to terminals no matter which user is logged in - Cisco "logging monitor",  and Linux ”/dev/ttyx’‘ support this concept; logging to specific or all user sessions (even multiple sessions with the same user id) – Linux ":omusrmsg:root", ":omusrmsg:*", and Juniper "user (username | *)" support this concept. A Juniper example: when the user logs in, logging begins if there is a username match using this Junos config command (asterisk means all users):

syslog {
   user (<username> | *) {
      <facility> <severity>;
      match "regular-expression";
   }
}

I agree that the model would be clearer if these cases were treated separately. I captured both requirements in a revision to the proposed syslog model where I modify the terminal action into two actions: one for terminal and one for session. The diff is small and is attached.

Please let me know what you think.

[js] The introduction says "We are using definitions of Syslog protocol from [RFC3164] in this draft." but the YANG model mostly references 5424.

[clw] I will include this in the next revision.

[js]  In section 3 maybe use the term "Remote Collector(s)" instead of Server(s) ? Collector seems more in line with RFC5424 (or "Remote Receiver" if others prefer that).

[clw] I will include this in the next revision.

[js]  In the Section 3 figure make all the Distributors have a common syntax for plural vs singular "Log Buffer(s)", "Log File(s)", "Remote Collector(s)", “User Terminal(s)”

[clw] I will include this in the next revision.

[js]  Document is missing the standard legend for the PYANG tree

[clw] I will include this in the next revision.

Thanks,

Clyde

From: netmod <[email-masked]<mailto:[email-masked]>> on behalf of "Sterne, Jason (Jason)" <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, October 28, 2015 at 11:50 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [netmod] syslog-model-05: terminal logging vs session logging

Hi all,

One of the syslog destinations in the model is the “terminal” (for all users or specific users).

Isn’t logging to a terminal more typically enabled on a CLI *session* basis rather than configured against a particular user ?

I believe it is also typical for session logging to stop/disappear when that session is ended (i.e. it is not persistent config).

I’m not sure it is typical to have configuration in a device that basically instructs the device to enable logging to the terminal for “user x” whenever that user later logs in (and if they had multiple login sessions then presumably log events would be delivered to each session).

I think session logging is something that is really purely CLI (i.e. interactive sessions with human users) and maybe not even applicable to configuration via NETCONF (since we’d never want to send a stream of syslog events as text to the NETCONF client/session like we do to the terminal for a CLI user).

In section 5 of the draft it mentions that syslog:log-actions/terminal maps to Cisco NXOS “logging monitor 2”.  I believe that is intended to enable logs to a particular *session* (not user).   IOS-XR behavior is similar.  The ALU SR OS logging config has the concept of sending (enabling) log events to a particular session (but not configured against a user).

Jason