
From ggolovinsky@qualys.com  Mon Apr  2 14:18:45 2012
Return-Path: <ggolovinsky@qualys.com>
X-Original-To: ops-area@ietfa.amsl.com
Delivered-To: ops-area@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 959B321F8674 for <ops-area@ietfa.amsl.com>; Mon,  2 Apr 2012 14:18:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.977
X-Spam-Level: 
X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ljugOYbwQd16 for <ops-area@ietfa.amsl.com>; Mon,  2 Apr 2012 14:18:45 -0700 (PDT)
Received: from mail-gy0-f172.google.com (mail-gy0-f172.google.com [209.85.160.172]) by ietfa.amsl.com (Postfix) with ESMTP id C515321F8666 for <ops-area@ietf.org>; Mon,  2 Apr 2012 14:18:37 -0700 (PDT)
Received: by ghbg16 with SMTP id g16so1665514ghb.31 for <ops-area@ietf.org>; Mon, 02 Apr 2012 14:18:37 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:mime-version:x-mailer:thread-index:date:message-id:subject:to :cc:content-type:x-gm-message-state; bh=3F2xTdKRfCs39K3KCqKpgap9xvXLz5j0yf45yExbAi4=; b=jGCiLf1lBwLTo5y2MXSBMq1vVJhqymIlmkw13ZD0Lz+tjvTcR5CUqGuIi3mbI/zqrO DnSGApsVKGzs9puirqT9l4sluQliO6wkClclkdf1oGtkT/Ai0OzH7ueufi3+U71SZZJH hGgrY6DEwFRBrQqfMdDdPTnEfunN0SjwTy0uhhDRdQCeOgrTYHZ+ZJZeMcnqLIF8gQYS Bjufv/imYPgkwMCH7EPvlm1qNHKcYh701k57zIZyRSbU/CLCOjN281MBjwNQqXfRdxiN bPi6UpbJll+Yy0+NR7+GtTn8ki14rZq+uTWvx5ZtQz5tCodmsPlp1cyqfRjV0yCWNgbL vP3A==
Received: by 10.236.138.197 with SMTP id a45mr7932695yhj.97.1333401517071; Mon, 02 Apr 2012 14:18:37 -0700 (PDT)
From: Gene Golovinsky <ggolovinsky@qualys.com>
MIME-Version: 1.0
X-Mailer: Microsoft Outlook 14.0
Thread-Index: Ac0RFcLHaGUQM3xBTwO5rD/YtRQf5Q==
Date: Mon, 2 Apr 2012 14:18:44 -0700
Message-ID: <bd9b43a910cc55404132530f4891d8d4@mail.gmail.com>
To: ops-area@ietf.org, Benoit Claise <bclaise@cisco.com>
Content-Type: text/plain; charset=ISO-8859-1
X-Gm-Message-State: ALoCoQkL5/UYFAioh9IZ/6yzDz0gfFRYF9RyVlbJYV4STegCFJL45ed9IXh2UyMVahQCjMl5mhRy
X-Mailman-Approved-At: Tue, 03 Apr 2012 04:25:24 -0700
Cc: opsawg-chairs@tools.ietf.org
Subject: [OPS-AREA] Cloud Logging Format
X-BeenThere: ops-area@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OPS Area e-mail list <ops-area.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ops-area>, <mailto:ops-area-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ops-area>
List-Post: <mailto:ops-area@ietf.org>
List-Help: <mailto:ops-area-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ops-area>, <mailto:ops-area-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Apr 2012 21:18:45 -0000

Hi Benoit.
During the WG session on Wed last week you suggested IPFIX as an
alternative and/or addition to Syslog.
Who would be recommended expert to help me understand your suggestion?

Thanks.
--Gene

From dromasca@avaya.com  Tue Apr  3 04:31:56 2012
Return-Path: <dromasca@avaya.com>
X-Original-To: ops-area@ietfa.amsl.com
Delivered-To: ops-area@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C021A21F84C9 for <ops-area@ietfa.amsl.com>; Tue,  3 Apr 2012 04:31:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.599
X-Spam-Level: 
X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9vkMSFR-ndny for <ops-area@ietfa.amsl.com>; Tue,  3 Apr 2012 04:31:56 -0700 (PDT)
Received: from de307622-de-outbound.net.avaya.com (de307622-de-outbound.net.avaya.com [198.152.71.100]) by ietfa.amsl.com (Postfix) with ESMTP id CD9C621F84CF for <ops-area@ietf.org>; Tue,  3 Apr 2012 04:31:55 -0700 (PDT)
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AgAFAE3fek+HCzI1/2dsb2JhbABDt3qBB4IJAQEBAQMBAQEPHgoxAwsMBAIBCA0BAwQBAQsGDAsBBgEmHwkIAQEEARIIGodnC6MelDAEkANjBJt1ih6CaQ
X-IronPort-AV: E=Sophos;i="4.75,362,1330923600"; d="scan'208";a="300208272"
Received: from unknown (HELO p-us1-erheast.us1.avaya.com) ([135.11.50.53]) by de307622-de-outbound.net.avaya.com with ESMTP; 03 Apr 2012 07:31:54 -0400
Received: from unknown (HELO 307622ANEX5.global.avaya.com) ([135.64.140.13]) by p-us1-erheast-out.us1.avaya.com with ESMTP; 03 Apr 2012 07:15:51 -0400
x-mimeole: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Tue, 3 Apr 2012 13:31:51 +0200
Message-ID: <EDC652A26FB23C4EB6384A4584434A0407710D8B@307622ANEX5.global.avaya.com>
In-Reply-To: <bd9b43a910cc55404132530f4891d8d4@mail.gmail.com>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: [OPS-AREA] Cloud Logging Format
Thread-Index: Ac0RFcLHaGUQM3xBTwO5rD/YtRQf5QAdsdYQ
References: <bd9b43a910cc55404132530f4891d8d4@mail.gmail.com>
From: "Romascanu, Dan (Dan)" <dromasca@avaya.com>
To: "Gene Golovinsky" <ggolovinsky@qualys.com>, <ops-area@ietf.org>, "Benoit Claise" <bclaise@cisco.com>
Cc: opsawg-chairs@tools.ietf.org
Subject: Re: [OPS-AREA] Cloud Logging Format
X-BeenThere: ops-area@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OPS Area e-mail list <ops-area.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ops-area>, <mailto:ops-area-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ops-area>
List-Post: <mailto:ops-area@ietf.org>
List-Help: <mailto:ops-area-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ops-area>, <mailto:ops-area-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 03 Apr 2012 11:31:56 -0000

Hi Gene,=20

Benoit is on vacation, so I will answer on his behalf. Some of the
active IPFIX contributors are Juergen Quittek, Nevil Brownlee, Paul
Aitken, Brian Trammell, and Benoit of course. There are more but this is
a good list to start from. RFC 5101 and RFC 5102 are the first
recommended. Look especially at the way the Information Elements are
being defined and extended by defining new IEs.=20

Regards,

Dan




> -----Original Message-----
> From: ops-area-bounces@ietf.org [mailto:ops-area-bounces@ietf.org] On
> Behalf Of Gene Golovinsky
> Sent: Tuesday, April 03, 2012 12:19 AM
> To: ops-area@ietf.org; Benoit Claise
> Cc: opsawg-chairs@tools.ietf.org
> Subject: [OPS-AREA] Cloud Logging Format
>=20
> Hi Benoit.
> During the WG session on Wed last week you suggested IPFIX as an
> alternative and/or addition to Syslog.
> Who would be recommended expert to help me understand your suggestion?
>=20
> Thanks.
> --Gene
> _______________________________________________
> OPS-AREA mailing list
> OPS-AREA@ietf.org
> https://www.ietf.org/mailman/listinfo/ops-area

From ggolovinsky@qualys.com  Tue Apr  3 10:23:29 2012
Return-Path: <ggolovinsky@qualys.com>
X-Original-To: ops-area@ietfa.amsl.com
Delivered-To: ops-area@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EEA9411E8083 for <ops-area@ietfa.amsl.com>; Tue,  3 Apr 2012 10:23:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.977
X-Spam-Level: 
X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yPZSEC6K4C6w for <ops-area@ietfa.amsl.com>; Tue,  3 Apr 2012 10:23:29 -0700 (PDT)
Received: from mail-qc0-f172.google.com (mail-qc0-f172.google.com [209.85.216.172]) by ietfa.amsl.com (Postfix) with ESMTP id 0531311E8072 for <ops-area@ietf.org>; Tue,  3 Apr 2012 10:23:28 -0700 (PDT)
Received: by qcsq13 with SMTP id q13so2923897qcs.31 for <ops-area@ietf.org>; Tue, 03 Apr 2012 10:23:28 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:references:in-reply-to:mime-version:x-mailer:thread-index:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=B1HJtwLFGo5/6O4KJR+1kJYZzKY7TzRYoPjUmb5hv7U=; b=RmqOxn5BIEj8yNsH4ylrJLgrrbKKl+edw+eaKpYnjw7xfZqM0tqmSDo56WUnBZxmn0 UkAKmE6IrI19d9fNn8u2b0wLISbBYi5vM8syk3bNZpXao2QZADah+nNWJ8T9479RDReX /OXGc1ppbxE/IPYQNH8XRNqegw4skRmZyUnuZL41/fei31iTI5OhKIDaPmxVVIardkhV Dfa8ONUWWXmdPfsF5bwrtnQFPyuZGFqtrJqYJ4s7lgy3hoETaxSeAsffea2LRU/Yj+ef YwQoGksh6gXFlh/paLpAr8N95+idIOO0mKttm9uR0iY1IhqUmxeeaSt7rmkzEl6fovDm xAxQ==
Received: by 10.224.95.205 with SMTP id e13mr16098576qan.30.1333473808213; Tue, 03 Apr 2012 10:23:28 -0700 (PDT)
From: Gene Golovinsky <ggolovinsky@qualys.com>
References: <bd9b43a910cc55404132530f4891d8d4@mail.gmail.com> <EDC652A26FB23C4EB6384A4584434A0407710D8B@307622ANEX5.global.avaya.com>
In-Reply-To: <EDC652A26FB23C4EB6384A4584434A0407710D8B@307622ANEX5.global.avaya.com>
MIME-Version: 1.0
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQKRQVJiUVE/G2oKf22xEQPqjJd/1gIQZNPelPB288A=
Date: Tue, 3 Apr 2012 10:23:37 -0700
Message-ID: <3d79cbcf2e3a6b4d4b0c3f5a6e8b8979@mail.gmail.com>
To: "Romascanu, Dan (Dan)" <dromasca@avaya.com>, ops-area@ietf.org,  Benoit Claise <bclaise@cisco.com>
Content-Type: text/plain; charset=ISO-8859-1
X-Gm-Message-State: ALoCoQml1b9acOPR6Soj68Ujb94OLv6hcexPenugD/zo9vWi+5jA+hdJCm1Ha3IbwcRPlZYwy3zu
X-Mailman-Approved-At: Tue, 03 Apr 2012 10:47:11 -0700
Cc: opsawg-chairs@tools.ietf.org
Subject: Re: [OPS-AREA] Cloud Logging Format
X-BeenThere: ops-area@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OPS Area e-mail list <ops-area.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ops-area>, <mailto:ops-area-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ops-area>
List-Post: <mailto:ops-area@ietf.org>
List-Help: <mailto:ops-area-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ops-area>, <mailto:ops-area-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 03 Apr 2012 17:23:30 -0000

Dan, thanks a lot!
Any more comments/discussions on the draft itself will be highly helpful
as well.

--Gene


-----Original Message-----
From: Romascanu, Dan (Dan) [mailto:dromasca@avaya.com]
Sent: Tuesday, April 03, 2012 04:32 AM
To: Gene Golovinsky; ops-area@ietf.org; Benoit Claise
Cc: opsawg-chairs@tools.ietf.org
Subject: RE: [OPS-AREA] Cloud Logging Format

Hi Gene,

Benoit is on vacation, so I will answer on his behalf. Some of the active
IPFIX contributors are Juergen Quittek, Nevil Brownlee, Paul Aitken, Brian
Trammell, and Benoit of course. There are more but this is a good list to
start from. RFC 5101 and RFC 5102 are the first recommended. Look
especially at the way the Information Elements are being defined and
extended by defining new IEs.

Regards,

Dan




> -----Original Message-----
> From: ops-area-bounces@ietf.org [mailto:ops-area-bounces@ietf.org] On
> Behalf Of Gene Golovinsky
> Sent: Tuesday, April 03, 2012 12:19 AM
> To: ops-area@ietf.org; Benoit Claise
> Cc: opsawg-chairs@tools.ietf.org
> Subject: [OPS-AREA] Cloud Logging Format
>
> Hi Benoit.
> During the WG session on Wed last week you suggested IPFIX as an
> alternative and/or addition to Syslog.
> Who would be recommended expert to help me understand your suggestion?
>
> Thanks.
> --Gene
> _______________________________________________
> OPS-AREA mailing list
> OPS-AREA@ietf.org
> https://www.ietf.org/mailman/listinfo/ops-area

From j.schoenwaelder@jacobs-university.de  Tue Apr  3 23:57:02 2012
Return-Path: <j.schoenwaelder@jacobs-university.de>
X-Original-To: ops-area@ietfa.amsl.com
Delivered-To: ops-area@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8784F21F865D for <ops-area@ietfa.amsl.com>; Tue,  3 Apr 2012 23:57:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.924
X-Spam-Level: 
X-Spam-Status: No, score=-102.924 tagged_above=-999 required=5 tests=[AWL=0.325, BAYES_00=-2.599, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NUpOFJ61XDaa for <ops-area@ietfa.amsl.com>; Tue,  3 Apr 2012 23:57:01 -0700 (PDT)
Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by ietfa.amsl.com (Postfix) with ESMTP id 9681021F865C for <ops-area@ietf.org>; Tue,  3 Apr 2012 23:57:01 -0700 (PDT)
Received: from localhost (demetrius4.jacobs-university.de [212.201.44.49]) by hermes.jacobs-university.de (Postfix) with ESMTP id E2B2120C28; Wed,  4 Apr 2012 08:56:59 +0200 (CEST)
X-Virus-Scanned: amavisd-new at jacobs-university.de
Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius4.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id AM8r9XexkrQZ; Wed,  4 Apr 2012 08:56:59 +0200 (CEST)
Received: from elstar.local (elstar.jacobs.jacobs-university.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 3794920C2C; Wed,  4 Apr 2012 08:56:57 +0200 (CEST)
Received: by elstar.local (Postfix, from userid 501) id D105F1E2DCEA; Wed,  4 Apr 2012 08:56:57 +0200 (CEST)
Date: Wed, 4 Apr 2012 08:56:57 +0200
From: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
To: Gene Golovinsky <ggolovinsky@qualys.com>
Message-ID: <20120404065655.GB13287@elstar.local>
References: <bd9b43a910cc55404132530f4891d8d4@mail.gmail.com> <EDC652A26FB23C4EB6384A4584434A0407710D8B@307622ANEX5.global.avaya.com> <3d79cbcf2e3a6b4d4b0c3f5a6e8b8979@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <3d79cbcf2e3a6b4d4b0c3f5a6e8b8979@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: opsawg-chairs@tools.ietf.org, ops-area@ietf.org
Subject: Re: [OPS-AREA] Cloud Logging Format
X-BeenThere: ops-area@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
List-Id: OPS Area e-mail list <ops-area.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ops-area>, <mailto:ops-area-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ops-area>
List-Post: <mailto:ops-area@ietf.org>
List-Help: <mailto:ops-area-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ops-area>, <mailto:ops-area-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Apr 2012 06:57:02 -0000

On Tue, Apr 03, 2012 at 10:23:37AM -0700, Gene Golovinsky wrote:
> Dan, thanks a lot!
> Any more comments/discussions on the draft itself will be highly helpful
> as well.

Let me repeat the question I asked at the meeting. From reading the
draft, it was not clear how the new SDEs are added to syslog messages.
Is it reasonable to assume that the originator of a syslog message has
the relevant information? If not, what does it take to distribute the
necessary information to the originators? Or is the idea that proxies
add SDEs while forwarding syslog messages? I like to see how this can
reasonably implemented and deployed.

I probably also have question what precisely the semantics of the
prosed SDEs are but that perhaps becomes clear once I understand where
the knowledge for which service/customer a log message is being
created is coming from and which component is expected to do the
tagging.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

From j.schoenwaelder@jacobs-university.de  Wed Apr  4 09:19:57 2012
Return-Path: <j.schoenwaelder@jacobs-university.de>
X-Original-To: ops-area@ietfa.amsl.com
Delivered-To: ops-area@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9AF421F877F for <ops-area@ietfa.amsl.com>; Wed,  4 Apr 2012 09:19:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.899
X-Spam-Level: 
X-Spam-Status: No, score=-102.899 tagged_above=-999 required=5 tests=[AWL=0.350, BAYES_00=-2.599, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LpBBEcnco8cD for <ops-area@ietfa.amsl.com>; Wed,  4 Apr 2012 09:19:57 -0700 (PDT)
Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by ietfa.amsl.com (Postfix) with ESMTP id DE11A21F8782 for <ops-area@ietf.org>; Wed,  4 Apr 2012 09:19:56 -0700 (PDT)
Received: from localhost (demetrius2.jacobs-university.de [212.201.44.47]) by hermes.jacobs-university.de (Postfix) with ESMTP id 3CACE20C45; Wed,  4 Apr 2012 18:19:56 +0200 (CEST)
X-Virus-Scanned: amavisd-new at jacobs-university.de
Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius2.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id JO5GjOVmXrl9; Wed,  4 Apr 2012 18:19:56 +0200 (CEST)
Received: from elstar.local (elstar.jacobs.jacobs-university.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 3082120C37; Wed,  4 Apr 2012 18:19:55 +0200 (CEST)
Received: by elstar.local (Postfix, from userid 501) id 0A25C1E2E963; Wed,  4 Apr 2012 18:19:54 +0200 (CEST)
Date: Wed, 4 Apr 2012 18:19:54 +0200
From: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
To: Gene Golovinsky <ggolovinsky@qualys.com>
Message-ID: <20120404161954.GA14811@elstar.local>
References: <bd9b43a910cc55404132530f4891d8d4@mail.gmail.com> <EDC652A26FB23C4EB6384A4584434A0407710D8B@307622ANEX5.global.avaya.com> <3d79cbcf2e3a6b4d4b0c3f5a6e8b8979@mail.gmail.com> <20120404065655.GB13287@elstar.local> <d4d229878285d875bfed8c78411e1a43@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <d4d229878285d875bfed8c78411e1a43@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: opsawg-chairs@tools.ietf.org, ops-area@ietf.org
Subject: Re: [OPS-AREA] Cloud Logging Format
X-BeenThere: ops-area@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
List-Id: OPS Area e-mail list <ops-area.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ops-area>, <mailto:ops-area-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ops-area>
List-Post: <mailto:ops-area@ietf.org>
List-Help: <mailto:ops-area-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ops-area>, <mailto:ops-area-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Apr 2012 16:19:58 -0000

On Wed, Apr 04, 2012 at 08:56:33AM -0700, Gene Golovinsky wrote:
 
> Let me repeat the question I asked at the meeting. From reading the draft,
> it was not clear how the new SDEs are added to syslog messages.
> Is it reasonable to assume that the originator of a syslog message has the
> relevant information?

> [Gene Golovinsky] Yes, the originator of the message, the actual logging
> entity should be aware of the information populated into the Syslog
> message

What is a logging entity? RFC 5424 talks about 'originators',
'collectors', and 'relays'. I hear you saying it is the syslog
originator.
 
> If not, what does it take to distribute the necessary information to the
> originators? Or is the idea that proxies add SDEs while forwarding syslog
> messages?

> [Gene Golovinsky] Yes again. As a request for service (API call)  travels
> through processing nodes those nodes add SDs to the message. Each node is
> aware of the context and can add appropriate SD.

I fail to understand this. Which API call? Who is calling this API?
Which nodes add SDs to messages (presumably SYSLOG messages?). Are we
now talking relays?

> I like to see how this can reasonably implemented and deployed.

> [Gene Golovinsky] I am not sure I understand this. It has been actually
> implemented and deployed by several vendors in their "cloud"
> implementations.

Such as? Sorry if I am ignorant. Do typical web servers do this sort
of thing or do you have some specific application frameworks in mind?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

From ggolovinsky@qualys.com  Wed Apr  4 14:18:59 2012
Return-Path: <ggolovinsky@qualys.com>
X-Original-To: ops-area@ietfa.amsl.com
Delivered-To: ops-area@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 34E5211E8110 for <ops-area@ietfa.amsl.com>; Wed,  4 Apr 2012 14:18:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.977
X-Spam-Level: 
X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JqPTswxzU+XQ for <ops-area@ietfa.amsl.com>; Wed,  4 Apr 2012 14:18:58 -0700 (PDT)
Received: from mail-qc0-f172.google.com (mail-qc0-f172.google.com [209.85.216.172]) by ietfa.amsl.com (Postfix) with ESMTP id 5D73011E8089 for <ops-area@ietf.org>; Wed,  4 Apr 2012 14:18:58 -0700 (PDT)
Received: by qcsq13 with SMTP id q13so529323qcs.31 for <ops-area@ietf.org>; Wed, 04 Apr 2012 14:18:57 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:references:in-reply-to:mime-version:x-mailer:thread-index:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=PZ7nYkMOEV7/NkBGj0NDTa6iflXQq+xHvElWqpEGGBU=; b=LdVznkRpn4vY9sFpT6d18rheU08ZCMU73T4gcpCz6kFZeYOgOnijNdO6quwTDRs6Bv Ro9xfOYGwXa/vd24pr4duNZdOZRIgpiF9+P8JFsOq2wdQgiJmDtlyzxf1xvkS0MRiMXk OhIJ60Au5v2+QsfVQP0PdLo7yRDzflMlb6QYpUSmq1LXSKBUarlpAzFoOOG1dhdm+4MF 5ISYlNFjW3agBa57auQPzT9OB8Bun+Z6v+hpzh+epxHVceRtbwhbXm1iAXeqYqggU2Wk TRdnzM/gWRDoTkVzdj8j30K14M7pr25+LPxpI6+8LvqdSKXxgxrma2T5Qx8gylA8nsLM l1jg==
Received: by 10.224.9.75 with SMTP id k11mr826730qak.17.1333574337560; Wed, 04 Apr 2012 14:18:57 -0700 (PDT)
From: Gene Golovinsky <ggolovinsky@qualys.com>
References: <bd9b43a910cc55404132530f4891d8d4@mail.gmail.com> <EDC652A26FB23C4EB6384A4584434A0407710D8B@307622ANEX5.global.avaya.com> <3d79cbcf2e3a6b4d4b0c3f5a6e8b8979@mail.gmail.com> <20120404065655.GB13287@elstar.local> <d4d229878285d875bfed8c78411e1a43@mail.gmail.com> <20120404161954.GA14811@elstar.local>
In-Reply-To: <20120404161954.GA14811@elstar.local>
MIME-Version: 1.0
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQKRQVJiUVE/G2oKf22xEQPqjJd/1gIQZNPeAe6iOqMCBQba2QHJ/2RXAh2kCjqUszcc4A==
Date: Wed, 4 Apr 2012 14:19:07 -0700
Message-ID: <68cdc385d2b25d4e239b7788cc476108@mail.gmail.com>
To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
Content-Type: text/plain; charset=ISO-8859-1
X-Gm-Message-State: ALoCoQlAqVh0Bh9T9b48p49LGHABo4psb/0vuRb6mVNgNWKvM8NwzaBnhCOZJf2TbXqw2dYjAoIM
Cc: opsawg-chairs@tools.ietf.org, ops-area@ietf.org
Subject: Re: [OPS-AREA] Cloud Logging Format
X-BeenThere: ops-area@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OPS Area e-mail list <ops-area.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ops-area>, <mailto:ops-area-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ops-area>
List-Post: <mailto:ops-area@ietf.org>
List-Help: <mailto:ops-area-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ops-area>, <mailto:ops-area-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Apr 2012 21:18:59 -0000

On Wed, Apr 04, 2012 at 08:56:33AM -0700, Gene Golovinsky wrote:

> [Gene Golovinsky] Yes, the originator of the message, the actual
> logging entity should be aware of the information populated into the
> Syslog message

What is a logging entity? RFC 5424 talks about 'originators',
'collectors', and 'relays'. I hear you saying it is the syslog originator.
[Gene Golovinsky] Yes, it is a syslog originator.

> If not, what does it take to distribute the necessary information to
> the originators? Or is the idea that proxies add SDEs while forwarding
> syslog messages?

> [Gene Golovinsky] Yes again. As a request for service (API call)
> travels through processing nodes those nodes add SDs to the message.
> Each node is aware of the context and can add appropriate SD.

I fail to understand this. Which API call? Who is calling this API?
Which nodes add SDs to messages (presumably SYSLOG messages?). Are we now
talking relays?
[Gene Golovinsky] I am referring to some of the scenarios discussed in the
examples in the draft. In "cloud" deployments in lots of cases actions
result in response to a request for service. This request is typically
done by calling a remote API (REST, or other Web Service like call). Such
an API call typically comes to a front end Web Server and then dispatched
to the backend. Backend may consists of multiple compute nodes. In some
cases requested service is satisfied by several compute nodes. Each node
should be able to add SDs to the log message. So these are probably not
relays, but rather distributed originators. These are not to be confused
with service gateways briefly discussed in the draft. Those gateways are
for passing service request/response and are also originators.

> I like to see how this can reasonably implemented and deployed.

> [Gene Golovinsky] I am not sure I understand this. It has been
> actually implemented and deployed by several vendors in their "cloud"
> implementations.

Such as? Sorry if I am ignorant. Do typical web servers do this sort of
thing or do you have some specific application frameworks in mind?
[Gene Golovinsky] No, the typical Web Server does not do this sort of
thing. This is more appropriate for SaaS and IaaS environments. I know of
several SaaS providers that implemented something like this and, at least
one IaaS vendor.



/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

From j.schoenwaelder@jacobs-university.de  Thu Apr  5 02:53:02 2012
Return-Path: <j.schoenwaelder@jacobs-university.de>
X-Original-To: ops-area@ietfa.amsl.com
Delivered-To: ops-area@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43F1B21F86F0 for <ops-area@ietfa.amsl.com>; Thu,  5 Apr 2012 02:53:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.004
X-Spam-Level: 
X-Spam-Status: No, score=-103.004 tagged_above=-999 required=5 tests=[AWL=0.245, BAYES_00=-2.599, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wY919rVUxjPh for <ops-area@ietfa.amsl.com>; Thu,  5 Apr 2012 02:53:01 -0700 (PDT)
Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by ietfa.amsl.com (Postfix) with ESMTP id 4419B21F86EB for <ops-area@ietf.org>; Thu,  5 Apr 2012 02:53:01 -0700 (PDT)
Received: from localhost (demetrius2.jacobs-university.de [212.201.44.47]) by hermes.jacobs-university.de (Postfix) with ESMTP id 321D020C21; Thu,  5 Apr 2012 11:53:00 +0200 (CEST)
X-Virus-Scanned: amavisd-new at jacobs-university.de
Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius2.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id aMCJmjhldErK; Thu,  5 Apr 2012 11:53:00 +0200 (CEST)
Received: from elstar.local (elstar.jacobs.jacobs-university.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 83E4220C10; Thu,  5 Apr 2012 11:52:59 +0200 (CEST)
Received: by elstar.local (Postfix, from userid 501) id 3CB911E56121; Thu,  5 Apr 2012 11:53:00 +0200 (CEST)
Date: Thu, 5 Apr 2012 11:52:59 +0200
From: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
To: Gene Golovinsky <ggolovinsky@qualys.com>
Message-ID: <20120405095259.GB10272@elstar.local>
References: <bd9b43a910cc55404132530f4891d8d4@mail.gmail.com> <EDC652A26FB23C4EB6384A4584434A0407710D8B@307622ANEX5.global.avaya.com> <3d79cbcf2e3a6b4d4b0c3f5a6e8b8979@mail.gmail.com> <20120404065655.GB13287@elstar.local> <d4d229878285d875bfed8c78411e1a43@mail.gmail.com> <20120404161954.GA14811@elstar.local> <68cdc385d2b25d4e239b7788cc476108@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <68cdc385d2b25d4e239b7788cc476108@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: opsawg-chairs@tools.ietf.org, ops-area@ietf.org
Subject: Re: [OPS-AREA] Cloud Logging Format
X-BeenThere: ops-area@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
List-Id: OPS Area e-mail list <ops-area.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ops-area>, <mailto:ops-area-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ops-area>
List-Post: <mailto:ops-area@ietf.org>
List-Help: <mailto:ops-area-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ops-area>, <mailto:ops-area-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Apr 2012 09:53:02 -0000

On Wed, Apr 04, 2012 at 02:19:07PM -0700, Gene Golovinsky wrote:
> On Wed, Apr 04, 2012 at 08:56:33AM -0700, Gene Golovinsky wrote:
> 
> > [Gene Golovinsky] Yes, the originator of the message, the actual
> > logging entity should be aware of the information populated into the
> > Syslog message
> 
> What is a logging entity? RFC 5424 talks about 'originators',
> 'collectors', and 'relays'. I hear you saying it is the syslog originator.
> [Gene Golovinsky] Yes, it is a syslog originator.
> 
> > If not, what does it take to distribute the necessary information to
> > the originators? Or is the idea that proxies add SDEs while forwarding
> > syslog messages?
> 
> > [Gene Golovinsky] Yes again. As a request for service (API call)
> > travels through processing nodes those nodes add SDs to the message.
> > Each node is aware of the context and can add appropriate SD.
> 
> I fail to understand this. Which API call? Who is calling this API?
> Which nodes add SDs to messages (presumably SYSLOG messages?). Are we now
> talking relays?
> [Gene Golovinsky] I am referring to some of the scenarios discussed in the
> examples in the draft. In "cloud" deployments in lots of cases actions
> result in response to a request for service. This request is typically
> done by calling a remote API (REST, or other Web Service like call). Such
> an API call typically comes to a front end Web Server and then dispatched
> to the backend. Backend may consists of multiple compute nodes. In some
> cases requested service is satisfied by several compute nodes. Each node
> should be able to add SDs to the log message. So these are probably not
> relays, but rather distributed originators. These are not to be confused
> with service gateways briefly discussed in the draft. Those gateways are
> for passing service request/response and are also originators.

I understand that you assume that a frontend passes information down
to the backend compute notes so that their implementation can put the
correct SDE into the SYSLOG messages.
 
> > I like to see how this can reasonably implemented and deployed.
> 
> > [Gene Golovinsky] I am not sure I understand this. It has been
> > actually implemented and deployed by several vendors in their "cloud"
> > implementations.
> 
> Such as? Sorry if I am ignorant. Do typical web servers do this sort of
> thing or do you have some specific application frameworks in mind?
> [Gene Golovinsky] No, the typical Web Server does not do this sort of
> thing. This is more appropriate for SaaS and IaaS environments. I know of
> several SaaS providers that implemented something like this and, at least
> one IaaS vendor.

I happen to run a normal web server in an IaaS environment. So I might
just be unlucky. Anyway, I like to see more discussion added to the
document how this is supposed to implemented and deployed. I like to
see less "could" language and see more "as done by XYZ" language or
even text explaining what information APIs need to move around to make
all this work.

And then there needs to be discussion the SDEs semantics and what they
really contain. For example, is it meaningful to identify a client by
an IP address in a world moving to shared NATs? What exactly are those
gateways? What exactly are the user identities and their formats?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

From ggolovinsky@qualys.com  Thu Apr  5 07:54:41 2012
Return-Path: <ggolovinsky@qualys.com>
X-Original-To: ops-area@ietfa.amsl.com
Delivered-To: ops-area@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2183921F86D0 for <ops-area@ietfa.amsl.com>; Thu,  5 Apr 2012 07:54:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.977
X-Spam-Level: 
X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SG4gde6qyvU3 for <ops-area@ietfa.amsl.com>; Thu,  5 Apr 2012 07:54:40 -0700 (PDT)
Received: from mail-qa0-f42.google.com (mail-qa0-f42.google.com [209.85.216.42]) by ietfa.amsl.com (Postfix) with ESMTP id 5C35721F86BE for <ops-area@ietf.org>; Thu,  5 Apr 2012 07:54:40 -0700 (PDT)
Received: by qafi31 with SMTP id i31so1408827qaf.15 for <ops-area@ietf.org>; Thu, 05 Apr 2012 07:54:39 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:references:in-reply-to:mime-version:x-mailer:thread-index:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=5zN3oRTBrRRTwJ9YBrnwOE8AN6hrhBCT+WQXkeSK2cQ=; b=TRDU5yAihGev0QfXDfsIi9jaGcfilRqT/Se08oIjU9nZMyBJIWFGX+Zpq/hy/E2Bqp gb1DDSiLV+PHw5M9wWt6veIXBdOk/lVM5Nrg1PjIAJD3kLlUuJDyzn1B3IP72CR/o85L MluyrjZSxY9l4zyo1uNB9+Hn2OEhsdstaBS7OCDtp2hN/r0V2ruJMMHA9cDcoHEa55hM EkbNLVpjW+EyH/PoOIuVLROp7mkS2PrlRJr8AstwPU0C9yNmvrlVAR7ePYAx8aKKtNEK RRWuedQN7euaAgZ/iG7elkpU7saY9VpDdOt/mHZMXpUt44umDDCdhDJycdEJYo4KtzLq oUwQ==
Received: by 10.229.136.131 with SMTP id r3mr1115572qct.129.1333637679542; Thu, 05 Apr 2012 07:54:39 -0700 (PDT)
From: Gene Golovinsky <ggolovinsky@qualys.com>
References: <bd9b43a910cc55404132530f4891d8d4@mail.gmail.com> <EDC652A26FB23C4EB6384A4584434A0407710D8B@307622ANEX5.global.avaya.com> <3d79cbcf2e3a6b4d4b0c3f5a6e8b8979@mail.gmail.com> <20120404065655.GB13287@elstar.local> <d4d229878285d875bfed8c78411e1a43@mail.gmail.com> <20120404161954.GA14811@elstar.local> <68cdc385d2b25d4e239b7788cc476108@mail.gmail.com> <20120405095259.GB10272@elstar.local>
In-Reply-To: <20120405095259.GB10272@elstar.local>
MIME-Version: 1.0
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQKRQVJiUVE/G2oKf22xEQPqjJd/1gIQZNPeAe6iOqMCBQba2QHJ/2RXAh2kCjoBM4MgagM2jrt6lJFGthA=
Date: Thu, 5 Apr 2012 07:54:50 -0700
Message-ID: <b838697ebfc0e42abc360f736dcc1023@mail.gmail.com>
To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
Content-Type: text/plain; charset=ISO-8859-1
X-Gm-Message-State: ALoCoQmLH6JYB+jToerXZVuTvYPmcF08oXLP4TePD0LZSL6bx0l2ZtxhwGgw/I1ehooqGppNR9tB
Cc: opsawg-chairs@tools.ietf.org, ops-area@ietf.org
Subject: Re: [OPS-AREA] Cloud Logging Format
X-BeenThere: ops-area@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OPS Area e-mail list <ops-area.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ops-area>, <mailto:ops-area-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ops-area>
List-Post: <mailto:ops-area@ietf.org>
List-Help: <mailto:ops-area-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ops-area>, <mailto:ops-area-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Apr 2012 14:54:41 -0000

> I fail to understand this. Which API call? Who is calling this API?
> Which nodes add SDs to messages (presumably SYSLOG messages?). Are we
> now talking relays?
> [Gene Golovinsky] I am referring to some of the scenarios discussed in
> the examples in the draft. In "cloud" deployments in lots of cases
> actions result in response to a request for service. This request is
> typically done by calling a remote API (REST, or other Web Service
> like call). Such an API call typically comes to a front end Web Server
> and then dispatched to the backend. Backend may consists of multiple
> compute nodes. In some cases requested service is satisfied by several
> compute nodes. Each node should be able to add SDs to the log message.
> So these are probably not relays, but rather distributed originators.
> These are not to be confused with service gateways briefly discussed
> in the draft. Those gateways are for passing service request/response
and are also originators.

I understand that you assume that a frontend passes information down to
the backend compute notes so that their implementation can put the correct
SDE into the SYSLOG messages.

> > I like to see how this can reasonably implemented and deployed.
>
> > [Gene Golovinsky] I am not sure I understand this. It has been
> > actually implemented and deployed by several vendors in their "cloud"
> > implementations.
>
> Such as? Sorry if I am ignorant. Do typical web servers do this sort
> of thing or do you have some specific application frameworks in mind?
> [Gene Golovinsky] No, the typical Web Server does not do this sort of
> thing. This is more appropriate for SaaS and IaaS environments. I know
> of several SaaS providers that implemented something like this and, at
> least one IaaS vendor.

I happen to run a normal web server in an IaaS environment. So I might
just be unlucky. Anyway, I like to see more discussion added to the
document how this is supposed to implemented and deployed. I like to see
less "could" language and see more "as done by XYZ" language or even text
explaining what information APIs need to move around to make all this
work.
[Gene Golovinsky] This sounds like a very reasonable comment. I will sure
take it into the account

And then there needs to be discussion the SDEs semantics and what they
really contain. For example, is it meaningful to identify a client by an
IP address in a world moving to shared NATs? What exactly are those
gateways? What exactly are the user identities and their formats?
[Gene Golovinsky] This is exactly where I am hoping to get experts to
help! Especially in the identity area.


/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

From ggolovinsky@qualys.com  Wed Apr  4 09:01:51 2012
Return-Path: <ggolovinsky@qualys.com>
X-Original-To: ops-area@ietfa.amsl.com
Delivered-To: ops-area@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3057F21F84AE for <ops-area@ietfa.amsl.com>; Wed,  4 Apr 2012 09:01:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.977
X-Spam-Level: 
X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Eb75Uv4wFBIP for <ops-area@ietfa.amsl.com>; Wed,  4 Apr 2012 09:01:50 -0700 (PDT)
Received: from mail-qa0-f42.google.com (mail-qa0-f42.google.com [209.85.216.42]) by ietfa.amsl.com (Postfix) with ESMTP id 464D221F849B for <ops-area@ietf.org>; Wed,  4 Apr 2012 09:01:49 -0700 (PDT)
Received: by qafi31 with SMTP id i31so584844qaf.15 for <ops-area@ietf.org>; Wed, 04 Apr 2012 09:01:49 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:references:in-reply-to:mime-version:x-mailer:thread-index:date :message-id:subject:to:cc:content-type:x-gm-message-state; bh=YpYm9NixgI3MOpR6m8+PlIjP9PBLktU7PAKrzAdMvH8=; b=N2QpHxKGBEOCfDF7iNakMSwdALsHi5+S6qI3A0ekvQt3YvyZsRzLL3XD1RgR1L2U97 PIOHgLCzDpaCvfSaCIxxSwNtlQ2xWsDFzo6QMIEjKk5Jfdwbk55SlIdrWSOxW5LvYTBk SxDjpM7gU69lW6EVWsM1h+j4mT6tUUdzzgyVEDvpkKeZwTaCkUhWm81Weh6DofWLr+pB zeTaYmMKTfDn/PwIe31eH/ZKkYaE0EZfd50QE9NpOQ0h8Efz/ZOpoEAjmzFKsiMuUQC6 I71K+XmlHj26ohsTdHD4tapNLZwJHxkIkV1my5f9Xxx7TZKy99xIE1J6cUv0x/4lUymP SEDA==
Received: by 10.224.10.20 with SMTP id n20mr6999901qan.4.1333554983203; Wed, 04 Apr 2012 08:56:23 -0700 (PDT)
From: Gene Golovinsky <ggolovinsky@qualys.com>
References: <bd9b43a910cc55404132530f4891d8d4@mail.gmail.com> <EDC652A26FB23C4EB6384A4584434A0407710D8B@307622ANEX5.global.avaya.com> <3d79cbcf2e3a6b4d4b0c3f5a6e8b8979@mail.gmail.com> <20120404065655.GB13287@elstar.local>
In-Reply-To: <20120404065655.GB13287@elstar.local>
MIME-Version: 1.0
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQKRQVJiUVE/G2oKf22xEQPqjJd/1gIQZNPeAe6iOqMCBQba2ZTSUWwQ
Date: Wed, 4 Apr 2012 08:56:33 -0700
Message-ID: <d4d229878285d875bfed8c78411e1a43@mail.gmail.com>
To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
Content-Type: text/plain; charset=ISO-8859-1
X-Gm-Message-State: ALoCoQlgEQjx5BTTZNDSQ1t/wKE6IdmBELf2UHtJBEdFILr1XoKyIUAtXMexUtOh5LsZSOm9rt7a
X-Mailman-Approved-At: Sat, 07 Apr 2012 14:17:27 -0700
Cc: opsawg-chairs@tools.ietf.org, ops-area@ietf.org
Subject: Re: [OPS-AREA] Cloud Logging Format
X-BeenThere: ops-area@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OPS Area e-mail list <ops-area.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ops-area>, <mailto:ops-area-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ops-area>
List-Post: <mailto:ops-area@ietf.org>
List-Help: <mailto:ops-area-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ops-area>, <mailto:ops-area-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Apr 2012 16:01:51 -0000

Hi Juegen.
Some answers are in-line
--Gene

-----Original Message-----
From: Juergen Schoenwaelder [mailto:j.schoenwaelder@jacobs-university.de]
Sent: Tuesday, April 03, 2012 11:57 PM
To: Gene Golovinsky
Cc: Romascanu, Dan (Dan); ops-area@ietf.org; Benoit Claise;
opsawg-chairs@tools.ietf.org
Subject: Re: [OPS-AREA] Cloud Logging Format

On Tue, Apr 03, 2012 at 10:23:37AM -0700, Gene Golovinsky wrote:
> Dan, thanks a lot!
> Any more comments/discussions on the draft itself will be highly
> helpful as well.

Let me repeat the question I asked at the meeting. From reading the draft,
it was not clear how the new SDEs are added to syslog messages.
Is it reasonable to assume that the originator of a syslog message has the
relevant information?
[Gene Golovinsky] Yes, the originator of the message, the actual logging
entity should be aware of the information populated into the Syslog
message

If not, what does it take to distribute the necessary information to the
originators? Or is the idea that proxies add SDEs while forwarding syslog
messages?
[Gene Golovinsky] Yes again. As a request for service (API call)  travels
through processing nodes those nodes add SDs to the message. Each node is
aware of the context and can add appropriate SD.

I like to see how this can reasonably implemented and deployed.
[Gene Golovinsky] I am not sure I understand this. It has been actually
implemented and deployed by several vendors in their "cloud"
implementations.

I probably also have question what precisely the semantics of the prosed
SDEs are but that perhaps becomes clear once I understand where the
knowledge for which service/customer a log message is being created is
coming from and which component is expected to do the tagging.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

From rbonica@juniper.net  Fri Apr 20 09:38:37 2012
Return-Path: <rbonica@juniper.net>
X-Original-To: ops-area@ietfa.amsl.com
Delivered-To: ops-area@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24B1F21F85C5; Fri, 20 Apr 2012 09:38:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.543
X-Spam-Level: 
X-Spam-Status: No, score=-106.543 tagged_above=-999 required=5 tests=[AWL=0.056, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EfnHZAincPyP; Fri, 20 Apr 2012 09:38:36 -0700 (PDT)
Received: from exprod7og126.obsmtp.com (exprod7og126.obsmtp.com [64.18.2.206]) by ietfa.amsl.com (Postfix) with ESMTP id 440E021F85C4; Fri, 20 Apr 2012 09:38:36 -0700 (PDT)
Received: from P-EMHUB01-HQ.jnpr.net ([66.129.224.36]) (using TLSv1) by exprod7ob126.postini.com ([64.18.6.12]) with SMTP ID DSNKT5GRCxXf2gQ2TsxHQeePVscdPDYSUK3i@postini.com; Fri, 20 Apr 2012 09:38:36 PDT
Received: from P-CLDFE01-HQ.jnpr.net (172.24.192.59) by P-EMHUB01-HQ.jnpr.net (172.24.192.35) with Microsoft SMTP Server (TLS) id 8.3.213.0; Fri, 20 Apr 2012 09:37:45 -0700
Received: from p-emfe02-wf.jnpr.net (172.28.145.25) by p-cldfe01-hq.jnpr.net (172.24.192.59) with Microsoft SMTP Server (TLS) id 14.1.355.2; Fri, 20 Apr 2012 09:37:44 -0700
Received: from EMBX01-WF.jnpr.net ([fe80::1914:3299:33d9:e43b]) by p-emfe02-wf.jnpr.net ([fe80::c126:c633:d2dc:8090%11]) with mapi; Fri, 20 Apr 2012 12:37:44 -0400
From: Ronald Bonica <rbonica@juniper.net>
To: "ops-area@ietf.org" <ops-area@ietf.org>, "ops-chairs@ietf.org" <ops-chairs@ietf.org>
Date: Fri, 20 Apr 2012 12:37:42 -0400
Thread-Topic: OPS Area Office Hours
Thread-Index: Ac0fE+hbtU1SkF2gRTW//nr5c/My0Q==
Message-ID: <13205C286662DE4387D9AF3AC30EF456D76A76104A@EMBX01-WF.jnpr.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: [OPS-AREA] OPS Area Office Hours
X-BeenThere: ops-area@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OPS Area e-mail list <ops-area.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ops-area>, <mailto:ops-area-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ops-area>
List-Post: <mailto:ops-area@ietf.org>
List-Help: <mailto:ops-area-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ops-area>, <mailto:ops-area-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Apr 2012 16:38:37 -0000

Folks,

Benoit and I would like to make ourselves available for office hours every =
other week. A schedule of office hours is posted at the following URL:

- https://svn.tools.ietf.org/area/ops/trac/wiki/OfficeHours

Feel free to share this information with your WGs if you wish.

--------------------------
Ron Bonica
vcard:       www.bonica.org/ron/ronbonica.vcf

