Subject: [Syslog] syslog over ssh

From: "Rainer Gerhards" <[email-masked]>
Date: Thu, 20 Jul 2006 09:25:14 +0200

Hi WG,

I just wanted to let you know that I have posted the individual
submission on syslog over ssh:

http://www1.ietf.org/mail-archive/web/i-d-announce/current/msg11360.html

I have done this idependendly of the transport-tls issue. It is, at
best, loosely connected (in that the work was spawned out of that
discussion). I think the idea of syslog over ssh is generally worth
thinking about and it is not implying that I expect -transport-tls to be
discarded. I am still of the opinion that work in that area should
progress (vote A). Please read the draft in that spirit.

Rainer

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "Rainer Gerhards" <[email-masked]>
Date: Fri, 21 Jul 2006 08:51:47 +0200

Anton, 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Anton Chuvakin
> Sent: Thursday, July 20, 2006 6:13 PM
> To: Rainer Gerhards
> Cc: [email-masked]
> Subject: Re: [Syslog] syslog over ssh
> 
> Rainer and all,
> 
> Just curious, how does it compare performance-wise to syslog-tls under
> whatever common implementations? Can you say that you'd recommended it
> sometimes over syslog-tls?

There are few current implementations, none native (tunnel mode is
used).

The main intent of this effort was not performance. So I did not
seriously consider performance implications. The main intent is that SSH
is becoming increasingly popular among operators for use with network
management protocols. For example, NETCONF now seems to focus pretty
much on ssh. So the overall idea is that a standardized syslog over ssh
capability helps with NM protocol convergence.

>From the performance point of view, I do not expect a significant
difference to syslog over TLS, at least after the initial session setup
is done. Initial setup, I think, will be more expensive for SSH based
syslog.

I hope this provides at least some clues to an answer ;)

Rainer