Subject: [Syslog] RE: [Syslog-sec] AD Review for draft-ietf-syslog-protocol-14

From: "Rainer Gerhards" <[email-masked]>
Date: Mon, 10 Oct 2005 17:17:03 +0200

Hi list,

I have talked offline to some collagues. Most of them share Alex (and
my) concerns on the name space designator size. However, all share the
concerns about just using x- as a prefix, thus providing no solution for
namespace collisions. Given the problems we often face with namespace
collisions, I think that we should actually require strict rules. So
while space is an issue, it is worth to sacrify some space (octets) to
solve the namespace issue. So we are in for namespace identifiers.

On the issue of what exactly to use, we talked about something like ssh,
but with shorter identifiers. Definitely, that would introduce a syntax
not yet used in other protocols, be it looks more intuitive that the
<enterpriseid>- prefix.

The suggestion is to use <name>@<enterpriseid>. So instead of

#1 [email-masked]

or

#2 19406-mySDID

we could use

mySDID@19406

(19406 is the Adiscon-assigend enterprise ID - is there an example ID
like the example.com domain?)

This is brief, close to SNMP and looks familiar.

Feedback is appreciated. If there are no objections to this approach, I
will create some text.

Rainer

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> Alexander Clemm (alex)
> Sent: Tuesday, October 04, 2005 9:10 PM
> To: Chris Lonvick (clonvick); David B Harrington
> Cc: [email-masked]
> Subject: RE: [Syslog-sec] AD Review for draft-ietf-syslog-protocol-14
> 
> In general, the "@example.company.com" name space is a nice idea.
> However, I am concerned about the length that this 
> introduces.  I would
> much prefer to have a more compact encoding, resembling what 
> parameters
> would look like in SDP more than what they would look like 
> XML (in terms
> of compactness).  This is one reason why I actually like the 
> proposal to
> use the company identifier (typically 3 digits) as prefix (followed by
> some delimiter) as was suggested to denote a private name space.
> 
> Just my 2 cents.
> --- Alex
> 
> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Chris
> Lonvick (clonvick)
> Sent: Monday, October 03, 2005 6:25 PM
> To: David B Harrington
> Cc: [email-masked]
> Subject: RE: [Syslog-sec] AD Review for draft-ietf-syslog-protocol-14
> 
> Hi David,
> 
> On Fri, 30 Sep 2005, David B Harrington wrote:
> 
> > Hi,
> >
> > Because I believe we should be working to integrate our network 
> > management standards, at least to the point they can secure and 
> > correlate data easily across NM interfaces, I would like to see the 
> > approach adopted by syslog to be similar to the approaches used by 
> > other IETF protocols, especially network management protocols.
> 
> I'd like that as well.
> 
> >
> > SNMP uses the vendor ID approach, managed by IANA.
> > Netconf has no data model, so we don't know what they will use for 
> > vendor extensions.
> > I'm not sure what ipfix is using.
> >
> > Who will manage the @cisco.com registrations? IANA or 
> another external
> 
> > agency? Will the assignments be as stable as IANA assignments?
> 
> The "[email-masked]" namespace for SSH is for private use 
> and will not
> be registered with anyone.  It's been working well enough for the SSH
> community with the warning of, "It is up to each domain how it manages
> its local namespace."  I will say that this practice in SSH is not as
> widespread as SNMP but it has been done and it seems to be working.
> 
> It would be good to have discussion of this on the mailing list and we
> can hopefully finalize what we want in Vancouver.  Your input would be
> appreciated.
> 
> Thanks,
> Chris
> _______________________________________________
> Syslog-sec mailing list
> [email-masked]
> http://www.employees.org/mailman/listinfo/syslog-sec
> _______________________________________________
> Syslog-sec mailing list
> [email-masked]
> http://www.employees.org/mailman/listinfo/syslog-sec
> 

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "David B Harrington" <[email-masked]>
Date: Mon, 10 Oct 2005 14:12:11 -0400

Hi,

Just for clarity, 
19406 is the IANA-assigned enterprise ID for Adiscon, not an
Adiscon-assigned enterprise ID.

I see the space-saving difference between #1 and the alternatives, and
prefer the shorter format. I also prefer the IANA-assigned identifier
since we are guaranteed that will not change, or will change in very
specific ways, whereas I am less convinced of the stability of domain
names.

I don't really see any effective difference between #2 and your
proposal, so either is fine with me. 

Unless, of course "-" is already a reserved character, and using "@"
means we're reserving yet another character for no particular benefit.
And if companies are already likely to use "@" in their messages for
other purposes, then making this an additional reserved character
would not be backwards compatible.

David Harrington
[email-masked]

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Rainer Gerhards
> Sent: Monday, October 10, 2005 11:17 AM
> To: [email-masked]
> Subject: [Syslog] RE: [Syslog-sec] AD Review 
> fordraft-ietf-syslog-protocol-14
> 
> Hi list,
>

---

From: "Andrew Ross" <[email-masked]>
Date: Tue, 11 Oct 2005 10:11:28 +1300

The idea of using "mySDID@19406" sounds like a good solution to me.

Regards

Andrew
Kiwi Enterprises

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Rainer Gerhards
Sent: Tuesday, 11 October 2005 4:17 a.m.
To: [email-masked]
Subject: [Syslog] RE: [Syslog-sec] AD Review
fordraft-ietf-syslog-protocol-14

Hi list,

or

#2 19406-mySDID

we could use

mySDID@19406

Rainer