Subject: RE: [Syslog] TCP and SSH Discussion - where are we heading to?

From: "Rainer Gerhards" <[email-masked]>
Date: Fri, 21 Oct 2005 16:53:14 +0200

Chris, 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Chris Lonvick

> Are you volunteering to write?  :)

I think we are not yet in a position we have something to write. I know
that you probably did not mean to start anything right now, but let me
use this message as a tool to voice my concerns.

Over the past months (years), we've done some good work in evolving
syslog. However, RFC 3195 is having a very hard time among implementors
and our last efforts on protocol have received very limited feedback
from the operator/end user camp. On the other hand, I know that there
*is* vital interest in syslog. It's easy to judge this by the interest
new implementations receive from the user base and also by the number of
deployments of syslog tools. Obviously, end-users tend to be interested
more in the actual software tools than in protocols.

But the low implementor participation and end-user adoption rate is
raising a very important question to me: are we still heading into the
right direction? What does it help if we create better and better
standards (assumed they are, which is obviously arguable) but nobody
cares? In practice, mostly non-official-standard solutions are being
asked form, developed and deployed. For example, I will begin to
implement plain tcp syslog with ssl encryption shortly. Not because it
is so secure or reliable - simply because there is so much demand for
it. Current approaches typically use plain tcp syslog together with
stunnel (which, by the way, is valid solution for many needs).

May be it is just me feeling some asynchronicity between what the field
is asking for and what we are doing.

If so, I would suggest that we try to obtain some broader feedback from
operators and implementors before going any further with new standards.
If there is a sufficiently large group of operators (maybe "just" in
terms of purchasing power) asking for some new protocol (or protocol
versions), we can probably make the implementors implement them.
Currently, I honestly feel it very hard to provide business reasoning
for creating something new...

Rainer

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Darren Reed <[email-masked]>
Date: Sat, 22 Oct 2005 13:09:50 +1000 (EST)

..
> stunnel (which, by the way, is valid solution for many needs).

Right.  This is close to the approach I took, over 5 years ago now,
that started this off.  I wasn't happy with the unbounded record
problem you have with TCP and so added a small header to mark the
start of messages.  This was more just for the sake of doing it than
any market driver(s).

> is asking for and what we are doing.

I think there has been too little feedback to this group and research done
by this group about how syslog is evolving "out there".

If someone is deploying a syslog using TCP solution, what are they likely
to do?  My bet is pick one software bundle and use it everywhere they can.
For the most part, this is going to be of most signifance to Linux people.
If you're using AIX, HP-UX or Solaris, chances are you don't have the
freedom to upgrade/replace syslogd so you're stuck using UDP.
If you're using various pieces of network equipment, I'm willing to bet
people use syslog/udp because that is what everyone does & understands,
removing problem of interoperable syslog/tcp implementations.

If you were a commercial Un*x vendor, what would it take you to want to
spend $$ on replacing your in-house syslogd?

Darren

---

From: Robert Malmgren <[email-masked]>
Date: Sat, 22 Oct 2005 09:36:17 +0200

[snip]

> removing problem of interoperable syslog/tcp implementations.

In general, I think that you're right.

> spend $$ on replacing your in-house syslogd?

Customer preasure?

A couple of ways of creating this customer preasure could be
* Writing some best practise documents on the topic.
* Writing an attack tree description on the different versions of the
  syslog protocols.

Tina Bird's material,
http://www.seclib.com/seclib/ids.general/syslog-attack-sigs.pdf, could
be a good starting point for a best practise material?

Another thing I think we must have in mind is the possibility that the
"market" for network logging might become proprietary, since it is
rumored that Microsoft is cooking some solution for enterprise logging.

> Darren

--Robert

---

From: Chris Lonvick <[email-masked]>
Date: Sun, 23 Oct 2005 18:03:16 -0700 (PDT)

Hi Rainer,

> for creating something new...

Very good points.  I've gotten a few separate emails asking if this is the 
right direction.  I'll raise this discussion in a new thread on the 
mailing list.

Thanks,
Chris