Subject: RE: Netconf Event Message as Working Group Document

From: "Hector Trevino \(htrevino\)" <[email-masked]>
Date: Tue, 8 Nov 2005 10:48:23 -0800

Yes, you may assume that. 
Hector

-----Original Message-----
From: Wijnen, Bert (Bert) [mailto:[email-masked]] 
Sent: Tuesday, November 08, 2005 11:02 AM
To: Hector Trevino (htrevino); [email-masked]
Cc: Sharon Chisholm; [email-masked]
Subject: RE: Netconf Event Message as Working Group Document

So may I assume you guys are implementing on top of an existing Cisco
NetConf implementation?

Bert

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of Hector Trevino (htrevino)
> Sent: Tuesday, November 08, 2005 18:44
> To: [email-masked]
> Cc: Sharon Chisholm; [email-masked]
> Subject: RE: Netconf Event Message as Working Group Document
> 
> 
> 
> Hi, that would be various people at Cisco who are interested in 
> NETCONF and think notification support is needed.
> Hector
>   
> 
> -----Original Message-----
> From: Juergen Schoenwaelder [mailto:[email-masked]]
> Sent: Tuesday, November 08, 2005 12:57 AM
> To: Hector Trevino (htrevino)
> Cc: Sharon Chisholm; [email-masked]
> Subject: Re: Netconf Event Message as Working Group Document
> 
> On Mon, Nov 07, 2005 at 07:43:16PM -0800, Hector Trevino (htrevino)
> wrote:
> > 
> > Sharon,
> > 
> > Agree with your suggestion. We'd like to see this work move
> ahead in
> > the NETCONF WG.
> 
> Who is "we" here?
> 
> /js
> 
> -- 
> Juergen Schoenwaelder		    International University Bremen
> <http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 
> 28725 Bremen,
> Germany
> 
> --
> to unsubscribe send a message to [email-masked] with the

> word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/netconf/>
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>

---

From: Andy Bierman <[email-masked]>
Date: Tue, 08 Nov 2005 11:10:55 -0800

>Yes, you may assume that.
Is this syslog, SNMP notification, or something new?

IMO, notifications in the original charter are not clearly enough specified
to be useful in this debate.  The first debate I want to have
is whether NETCONF should invent a new event system
or adopt/invent NETCONF XML encodings of syslog and/or SNMP notifications.

Anyone one the list with an opinion, please speak up!

>Hector

Andy

---

From: Phil Shafer <[email-masked]>
Date: Tue, 08 Nov 2005 14:58:34 -0500

>Anyone one the list with an opinion, please speak up!

Hey, that's me!! ;^)

I do feel that we need more than syslog.  In particular, I want
to be able to say "give me all the events from the last 20 minutes
that relate to interface fe-1/2/3.0".  So I need to be able to
ship specific fields in addition to the message text.  Consider:

    <notification>
      <time seconds=234532455432345>Oct 18 16:01:37</time>
      <tag>RPD_RSVP_NBRUP</tag>
      <hostname>farmer-john</hostname>
      <process pid=2958>rpd</process>
      <data>
        <neighbor>10.5.14.2</neighbor>
        <interface>fe-1/3/0.0</interface>
      </data>
      <message>RSVP neighbor 10.5.14.2 up on interface fe-1/3/0.0</message>
    </notification>

Yes, I hear you gag on the obnoxious verbosity compared with the
traditional syslog line:

Oct 18 16:01:37  farmer-john rpd[2958]: RPD_RSVP_NBRUP: RSVP neighbor 10.5.14.2 up on interface fe-1/3/0.0

And yes, I will be trafficing and storing these messages _far_ more than
I'll be searching them, so the wasted bandwidth and storage _does_ matter.

The bit of functionality I do want is being able to say:

    notification[starts-with(data/interface, $device)]

and get better results than "grep $device /var/log/messages".

The new XML-ified syslog formats don't give me any of the above.
They only put the message text in a xml element.  I still haven't
read the netconf-event spec, but skimming it, I don't see much about
real data content.

I do see the "rpc-one-way" which seems wildly confusing, as it's
not an RPC at all.  It's an async message from the server to the
client, where an RPC is a remote procedure call from the client to
the server.

Anyway, the question to me is how can I break out my individual
fields (the data I care most about) without making 400 byte messages?
I don't think the answer is XML or ASN.1, or YAML.  But some simple
ascii field encoding that will support later operations that are
rare, complex, and must be accurate.

Thanks,
 Phil

---

From: Andy Bierman <[email-masked]>
Date: Tue, 08 Nov 2005 12:14:20 -0800

>Oct 18 16:01:37  farmer-john rpd[2958]: RPD_RSVP_NBRUP: RSVP neighbor 10.5.14.2 up on interface fe-1/3/0.0

XML-ification of syslog contents is what I meant in my last message.
IMO, what you describe here is not re-inventing syslog but rather
mapping syslog string message format to NETCONF XML format in a
predictable way. (I hope that's what you meant :-)

Andy

---

From: "David B Harrington" <[email-masked]>
Date: Tue, 8 Nov 2005 13:13:26 -0800

Hi,

I have an opinion.

I think there is real value in being able to correlate snmp
notifications with syslog messages, and likely with other event-driven
communications.

I have concerns with developing another type of notificaiton before
integrating with existing solutions. The ISMS WG was chartered because
operators expressed an interest in not having to deal with yet-another
solution for security. I have not seen strong demand for yet-another
solution for notifications.

The event draft invents a new format with new content. There appears
to be some correlation with ITU-style of events management, and an
effort to reuse designs from ITU and other SDOs may be an important
benefit, but I'd rather see us address reuse of/correlation with our
own standards first.

My professional role is typically as an NM architect for an equipment
vendor, and I would have trouble evangelizing the adoption of this
technology in my employer's devices and application without having a
much stronger case made for the benefits of this new work compared to
existing notification solutions.

If a proposed event messaging solution provided a means for carrying
SNMP notifications and syslog messages and a means to correlate them
(e.g. with timestamps or event IDs), that would be a benefit I could
try to sell as a benefit to customers. A tie-in to ITU-style events
and alarms might be an additional benefit I might be able to
evangelize. I am not convinced the current draft provide thos
benefits, but it is possible they could be added if consensus was to
do so.

One of the justification for netconf is its textual format -
explicitly because operators want to be able to save configurations in
source code control systems that cannot handle binary, so those
configurations can be distributed to multiple endpoints after
modification using standard text-editing tools. I don't see how
defining notifications/events in XML helps solve that problem. 

I don't want to say we should not accept these documents, but neither
do I want to say we should. I was one of the attendees to the editing
session, and I went to understand what progress has been made, as did
others. I don't think there has been adequate demonstration of the
need for this work; more work is needed. I have difficulty asking a
product manager to add this new feature to equipment without some
proof of value or demand, especially since netconf itself has not yet
been proven useful to or in demand by operators.

So far, netconf has not been successfully tested for interoperability,
largely because there are no vendor-neutral data models to test with.
I think that is more important to establish some basic vendor-neutral
data models than to add new features. The success of SNMP was partly
because there were vendor-neutral mib  modules to work with. 

But I have a vendor's perspective, and we really should get the
operator view. Do operators want another information/data model for
events? Do they want the correlation between SNMP, Netconf, and syslog
events? Is this more important than establishing a mechanism for
standardizing data modeling? Is it important to operators to be able
to access SNMP data via netconf?

David Harrington
[email-masked]

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Andy Bierman
> Sent: Tuesday, November 08, 2005 11:11 AM
> Cc: Wijnen, Bert (Bert); [email-masked]; Sharon 
> Chisholm; [email-masked]