From MAILER-DAEMON Mon Nov 28 10:57:42 2005 Date: 28 Nov 2005 10:57:42 -0600 From: Mail System Internal Data Subject: DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA Message-ID: <1133197062@linux.local> X-IMAP: 1133196617 0000000034 Status: RO This text is part of the internal format of your mail folder, and is not a real message. It is created automatically by the mail system software. If deleted, important folder data will be lost, and it will be re-created with the data reset to initial values. From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:51:54 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 70B1A19046 for ; Mon, 22 Aug 2005 18:51:54 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:51:54 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 4 Jul 2005 05:00:43 -0700 Received: from ams-iport-1.cisco.com ([144.254.224.140]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 4 Jul 2005 05:00:42 -0700 Received: from ams-core-1.cisco.com (144.254.224.150) by ams-iport-1.cisco.com with ESMTP; 04 Jul 2005 14:00:39 +0200 Received: from sj-inbound-c.cisco.com (sj-inbound-c.cisco.com [128.107.234.206]) by ams-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j64C0BDm028594; Mon, 4 Jul 2005 14:00:30 +0200 (MEST) Received: from willers.employees.org (192.83.249.36) by sj-inbound-c.cisco.com with ESMTP; 04 Jul 2005 05:00:05 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,256,1115017200"; d="scan'208"; a="78137606:sNHT18758412" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 1D61F5C76B; Mon, 4 Jul 2005 04:59:29 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from taloa.unice.fr (taloa.unice.fr [134.59.1.7]) by willers.employees.org (Postfix) with ESMTP id 5FEBD5C76B for ; Mon, 4 Jul 2005 04:59:16 -0700 (PDT) Received: from echo.unice.fr (echo.unice.fr [134.59.2.29]) by taloa.unice.fr (8.13.1/8.13.1) with ESMTP id j64Bx66s015075; Mon, 4 Jul 2005 13:59:07 +0200 Received: from mistral.unice.fr (mistral.unice.fr [134.59.2.10]) by echo.unice.fr (Postfix) with ESMTP id 8BDDB2AF0; Mon, 4 Jul 2005 13:59:06 +0200 (CEST) Received: by mistral.unice.fr (Postfix, from userid 10415) id 28DEA1C6; Mon, 4 Jul 2005 13:59:05 +0200 (CEST) Date: Mon, 4 Jul 2005 13:59:05 +0200 To: Rainer Gerhards Subject: Re: [Syslog-sec] I-D ACTION:draft-ietf-syslog-protocol-12.txt Message-ID: <20050704115905.GA2700@mistral.unice.fr> References: <577465F99B41C842AAFBE9ED71E70ABA0E34AA@grfint2.intern.adiscon.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA0E34AA@grfint2.intern.adiscon.com> User-Agent: Mutt/1.3.28i From: dalmassd@echo.unice.fr (Didier DALMASSO) Cc: syslog-sec@employees.org X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.234.206 X-OriginalArrivalTime: 04 Jul 2005 12:00:43.0054 (UTC) FILETIME=[0102E4E0:01C58090] Status: RO X-Status: X-Keywords: X-UID: 1 Rainer, I agree with this. But I have some minor remarks. I see the post of Steve Chang, I think that it's a good solution. But it's too bad that the size of the truncation's field varies _during transport_. Moreover it is necessary to pay attention to the size during truncation. Examples : message 1: length is 3000 octets and truncate value is 0. A relay truncates it to 2048 on STRUCTURED-DATA. Put 8 + 1 in TRUNCATE field ==> length = 2048. It's OK. message 2: length is 3000 octets and truncate value is 0. a relay truncate it to 2048 on MSG. Put 8 + 2 in TRUNCATE field ==> length = 2049. Implementor must pay attention ! Perhaps it's adapted to announce it. Thanks On Tue, Jun 28, 2005 at 10:30:31AM +0200, Rainer Gerhards wrote: > Didier, > > I have included most of the changes. Please see comments below. > > Rainer > > > -----Original Message----- > > From: syslog-sec-bounces@www.employees.org > > [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of > > Didier DALMASSO > > Sent: Friday, June 03, 2005 11:51 AM > > To: syslog-sec@employees.org > > Subject: Re: [Syslog-sec] I-D ACTION:draft-ietf-syslog-protocol-12.txt > > > > Hi, > > > > I've noticed some inaccuracies for the truncation at the initial > > sender. I suggest several modifications : > > > > in section 6 > > --------- > > < > > TRUNCATE = "0" / "1" / "2" / "3" > > > > > TRUNCATE = "0" / "1" / "2" / "3" / "5" / "6" / "7" > > --------- > > changed to 1*2DIGIT > > > > > > in section 6.1 Message Lentgh > > --------- > > < > > Receivers SHOULD follow this order of preferrence when it comes to > > truncation: > > > > > If a sender have a message with a length larger than 2,048 > > octets, the > > sender MAY send it complete or truncate the payload before send it. > > I have NOT included that change, because it implies that a sender can > only truncate if the length is larger than 2,048. In fact, a sender > might decide to truncate if the size if larger than 480 octets. However, > I think we need not point out the size restrictions at this point again. > > > If there is a very strong argument to do so, I would like to hear it. > > > > > This order of preferrence SHOULD be follow when it comes to > > truncation: > > --------- > > < > > When a receiver truncates a message, the TRUNCATE field > > (Section 6.2.4) MUST be updated. Please note that this will break > > eventually existing digital signatures. > > > > > When a receiver or initial sender truncates a message, the TRUNCATE > > field (Section 6.2.4) MUST be updated. In the case of a receiver, > > please note that this will break eventually existing digital > > signatures. > > --------- > > changed > > > > > > > in section 6.2.4 TRUNCATE > > --------- > > < > > The TRUNCATE field is used to indicate if the message has been > > truncated since it was sent. Such a truncation might happen on any > > receiver, including receivers on interim systems (relays). > > Values in > > the TRUNCATE field are made up of bits. Each of this bits has been > > assigned a specific value so that there is no doubt about bit > > ordering. The following values MUST be used: > > > > VALUE Meaning > > 1 all or some SD-ELEMENTs were truncated > > 2 all or part of MSG was truncated > > 4 truncation occured at the initial sender > > > > If the initial sender truncates a message, this MUST be > > inidicated by > > setting the "truncation occured at the initial sender" bit > > (value 4). > > > > > The TRUNCATE field is used to indicate if the message has been > > truncated since it was sent or generated by an application. > > Such a truncation might happen on the initial sender and any > > receiver, including receivers on interim systems (relays). > > Values in > > the TRUNCATE field are made up of bits. Each of this bits has been > > assigned a specific value so that there is no doubt about bit > > ordering. The following values MUST be used: > > > > VALUE Meaning > > 1 all or some SD-ELEMENTs were truncated > > 2 all or part of MSG was truncated > > 4 truncation occurred at the initial sender > > > > The value in the TRUNCATE field is the ASCII > > representation of these > > ORed bits. If the initial sender truncates a message, this MUST be > > indicated by setting the "truncation occured at the initial sender" > > bit (value 4). In the case of the truncation occured at the initial > > sender and at a receiver (relay or collector), he MUST > > unset the third > > bit (value 4). This allows to detect the signature is invalid. > > --------- > > I've changed this partly. I have not included the "unset bit 4" rule, > because I do not think this really makes sense. When the initial sender > truncates the message AND the receiver also truncates the message, we > have two truncations, but the later does not undo the initial one. I > think you main concern is about signature. I got another suggestion to > include value for truncation at interim systems (8) and the receiver > (16). These are now included. So in your secenario (both sender and > receiver truncate), the value would be 20 - and thus the receiver can > detect that the signature is invalid. I think this addresses you > concern. > > > > > and for the next paragraph: > > > > --------- > > Some examples: If no truncation occured, TRUNCATE MUST have a value > > of 0. If SD-ELEMENTs were truncated on the receiver, TRUNCATE MUST > > have a value of 1. If they were truncated on the initial sender, > > TRUNCATE must have the value of 5. If structured data and MSG were > > truncated on an interim system, TRUNCATE MUST have the value 3. If > > only MSG was truncated on the initial sender, TRUNCATE MUST have the > > value 6. > > --------- > > > > s/must have the value of 5/MUST have the value of 5/ > > > > Thanks, > > > > -- > > Didier Dalmasso > > _______________________________________________ > > Syslog-sec mailing list > > Syslog-sec@www.employees.org > > http://www.employees.org/mailman/listinfo/syslog-sec > > > _______________________________________________ > Syslog-sec mailing list > Syslog-sec@www.employees.org > http://www.employees.org/mailman/listinfo/syslog-sec _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:51:55 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 248FA19046 for ; Mon, 22 Aug 2005 18:51:55 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:51:55 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 4 Jul 2005 05:03:18 -0700 Received: from sj-iport-1.cisco.com ([171.71.176.70]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 4 Jul 2005 05:03:17 -0700 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-1.cisco.com with ESMTP; 04 Jul 2005 05:03:15 -0700 X-IronPort-AV: i="3.93,256,1115017200"; d="scan'208"; a="646975693:sNHT82073934" Received: from sj-inbound-a.cisco.com (sj-inbound-a.cisco.com [128.107.234.204]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j64C3FvO022824; Mon, 4 Jul 2005 05:03:15 -0700 (PDT) Received: from willers.employees.org (192.83.249.36) by sj-inbound-a.cisco.com with ESMTP; 04 Jul 2005 05:02:48 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,256,1115017200"; d="scan'208"; a="137114224:sNHT21819372" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 4E3115C7CD; Mon, 4 Jul 2005 05:02:44 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from ipx10102.ipxserver.de (mailin.adiscon.com [80.190.240.92]) by willers.employees.org (Postfix) with ESMTP id 1F6785C7F6 for ; Mon, 4 Jul 2005 05:02:43 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by ipx10102.ipxserver.de (Postfix) with ESMTP id D9D391B00BD; Mon, 4 Jul 2005 14:02:41 +0200 (CEST) Received: from ipx10102.ipxserver.de ([127.0.0.1]) by localhost (ipx10102 [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 19687-04; Mon, 4 Jul 2005 14:02:37 +0200 (CEST) Received: from fmint2.intern.adiscon.com (pD95B68D5.dip0.t-ipconnect.de [217.91.104.213]) by ipx10102.ipxserver.de (Postfix) with ESMTP id B7A7C1B0007; Mon, 4 Jul 2005 14:02:36 +0200 (CEST) Received: from grfint2.intern.adiscon.com ([172.19.0.6]) by fmint2.intern.adiscon.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 4 Jul 2005 14:02:31 +0200 Content-class: urn:content-classes:message Subject: RE: [Syslog-sec] I-D ACTION:draft-ietf-syslog-protocol-12.txt MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 4 Jul 2005 14:02:37 +0200 Message-ID: <577465F99B41C842AAFBE9ED71E70ABA0E352F@grfint2.intern.adiscon.com> X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Syslog-sec] I-D ACTION:draft-ietf-syslog-protocol-12.txt Thread-Index: AcWAj9nev3aP6beCRfuc3F8LvvrP9AAAEI4w From: "Rainer Gerhards" To: "Didier DALMASSO" X-OriginalArrivalTime: 04 Jul 2005 12:02:31.0449 (UTC) FILETIME=[419EA890:01C58090] X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at adiscon.com Cc: syslog-sec@employees.org X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org Status: RO X-Status: X-Keywords: X-UID: 2 Didier, thanks for the good point. I think I'll put a note in the informative appendix. I plan to do this soon, so that we can proceed further. Do you have any further feedback from implementing the draft that should go into it? If so, I would love to hear it. Thanks, Rainer=20 > -----Original Message----- > From: Didier DALMASSO [mailto:dalmassd@echo.unice.fr]=20 > Sent: Monday, July 04, 2005 1:59 PM > To: Rainer Gerhards > Cc: syslog-sec@employees.org > Subject: Re: [Syslog-sec] I-D ACTION:draft-ietf-syslog-protocol-12.txt >=20 > Rainer, >=20 > I agree with this. But I have some minor remarks. >=20 > I see the post of Steve Chang, I think that it's a good solution. But > it's too bad that the size of the truncation's field varies _during > transport_. Moreover it is necessary to pay attention to the size > during truncation. >=20 > Examples : > message 1: length is 3000 octets and truncate value is 0. > A relay truncates it to 2048 on STRUCTURED-DATA. Put 8 + 1 in TRUNCATE > field > =3D=3D> length =3D 2048. It's OK. >=20 > message 2: length is 3000 octets and truncate value is 0. > a relay truncate it to 2048 on MSG. Put 8 + 2 in TRUNCATE field = =3D=3D> > length =3D 2049. Implementor must pay attention ! >=20 > Perhaps it's adapted to announce it. >=20 > Thanks >=20 > On Tue, Jun 28, 2005 at 10:30:31AM +0200, Rainer Gerhards wrote: > > Didier, > >=20 > > I have included most of the changes. Please see comments below. > >=20 > > Rainer > >=20 > > > -----Original Message----- > > > From: syslog-sec-bounces@www.employees.org=20 > > > [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of=20 > > > Didier DALMASSO > > > Sent: Friday, June 03, 2005 11:51 AM > > > To: syslog-sec@employees.org > > > Subject: Re: [Syslog-sec] I-D=20 > ACTION:draft-ietf-syslog-protocol-12.txt > > >=20 > > > Hi, > > >=20 > > > I've noticed some inaccuracies for the truncation at the initial > > > sender. I suggest several modifications : > > >=20 > > > in section 6 > > > --------- > > > < > > > TRUNCATE =3D "0" / "1" / "2" / "3" > > > > > > > TRUNCATE =3D "0" / "1" / "2" / "3" / "5" / "6" / "7" > > > --------- > >=20 > > changed to 1*2DIGIT > > >=20 > > >=20 > > > in section 6.1 Message Lentgh > > > --------- > > > < > > > Receivers SHOULD follow this order of preferrence when=20 > it comes to > > > truncation: > > > > > > > If a sender have a message with a length larger than 2,048=20 > > > octets, the > > > sender MAY send it complete or truncate the payload=20 > before send it. > >=20 > > I have NOT included that change, because it implies that a=20 > sender can > > only truncate if the length is larger than 2,048. In fact, a sender > > might decide to truncate if the size if larger than 480=20 > octets. However, > > I think we need not point out the size restrictions at this=20 > point again. > >=20 > >=20 > > If there is a very strong argument to do so, I would like=20 > to hear it. > >=20 > > >=20 > > > This order of preferrence SHOULD be follow when it comes to > > > truncation: > > > --------- > > > < > > > When a receiver truncates a message, the TRUNCATE field > > > (Section 6.2.4) MUST be updated. Please note that this will break > > > eventually existing digital signatures. > > > > > > > When a receiver or initial sender truncates a message,=20 > the TRUNCATE > > > field (Section 6.2.4) MUST be updated. In the case of a receiver, > > > please note that this will break eventually existing digital > > > signatures. > > > --------- > >=20 > > changed > >=20 > > >=20 > > >=20 > > > in section 6.2.4 TRUNCATE > > > --------- > > > < > > > The TRUNCATE field is used to indicate if the message has been > > > truncated since it was sent. Such a truncation might=20 > happen on any > > > receiver, including receivers on interim systems (relays).=20 > > > Values in > > > the TRUNCATE field are made up of bits. Each of this=20 > bits has been > > > assigned a specific value so that there is no doubt about bit > > > ordering. The following values MUST be used: > > >=20 > > > VALUE Meaning > > > 1 all or some SD-ELEMENTs were truncated > > > 2 all or part of MSG was truncated > > > 4 truncation occured at the initial sender > > >=20 > > > If the initial sender truncates a message, this MUST be=20 > > > inidicated by > > > setting the "truncation occured at the initial sender" bit=20 > > > (value 4). > > > > > > > The TRUNCATE field is used to indicate if the message has been > > > truncated since it was sent or generated by an application. > > > Such a truncation might happen on the initial sender and any > > > receiver, including receivers on interim systems (relays).=20 > > > Values in > > > the TRUNCATE field are made up of bits. Each of this=20 > bits has been > > > assigned a specific value so that there is no doubt about bit > > > ordering. The following values MUST be used: > > >=20 > > > VALUE Meaning > > > 1 all or some SD-ELEMENTs were truncated > > > 2 all or part of MSG was truncated > > > 4 truncation occurred at the initial sender > > >=20 > > > The value in the TRUNCATE field is the ASCII=20 > > > representation of these > > > ORed bits. If the initial sender truncates a message,=20 > this MUST be > > > indicated by setting the "truncation occured at the=20 > initial sender" > > > bit (value 4). In the case of the truncation occured=20 > at the initial > > > sender and at a receiver (relay or collector), he MUST=20 > > > unset the third > > > bit (value 4). This allows to detect the signature is invalid. > > > --------- > >=20 > > I've changed this partly. I have not included the "unset=20 > bit 4" rule, > > because I do not think this really makes sense. When the=20 > initial sender > > truncates the message AND the receiver also truncates the=20 > message, we > > have two truncations, but the later does not undo the initial one. I > > think you main concern is about signature. I got another=20 > suggestion to > > include value for truncation at interim systems (8) and the receiver > > (16). These are now included. So in your secenario (both sender and > > receiver truncate), the value would be 20 - and thus the=20 > receiver can > > detect that the signature is invalid. I think this addresses you > > concern. > >=20 > > >=20 > > > and for the next paragraph: > > >=20 > > > --------- > > > Some examples: If no truncation occured, TRUNCATE MUST=20 > have a value > > > of 0. If SD-ELEMENTs were truncated on the receiver,=20 > TRUNCATE MUST > > > have a value of 1. If they were truncated on the initial sender, > > > TRUNCATE must have the value of 5. If structured data=20 > and MSG were > > > truncated on an interim system, TRUNCATE MUST have the=20 > value 3. If > > > only MSG was truncated on the initial sender, TRUNCATE=20 > MUST have the > > > value 6. > > > --------- > > >=20 > > > s/must have the value of 5/MUST have the value of 5/ > > >=20 > > > Thanks, > > >=20 > > > --=20 > > > Didier Dalmasso > > > _______________________________________________ > > > Syslog-sec mailing list > > > Syslog-sec@www.employees.org > > > http://www.employees.org/mailman/listinfo/syslog-sec > > >=20 > > _______________________________________________ > > Syslog-sec mailing list > > Syslog-sec@www.employees.org > > http://www.employees.org/mailman/listinfo/syslog-sec >=20 _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:51:56 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 720E219046 for ; Mon, 22 Aug 2005 18:51:56 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:51:56 -0500 (CDT) Received: from xbh-sjc-231.amer.cisco.com ([128.107.191.100]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 5 Jul 2005 07:06:22 -0700 Received: from ind-iport-1.cisco.com ([64.104.129.195]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 5 Jul 2005 07:06:21 -0700 Received: from india-core-1.cisco.com (64.104.129.221) by ind-iport-1.cisco.com with ESMTP; 05 Jul 2005 19:46:47 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,261,1115017200"; d="scan'208"; a="42906877:sNHT28809116" Received: from sj-inbound-d.cisco.com (sj-inbound-d.cisco.com [128.107.243.13]) by india-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j65E45be008436; Tue, 5 Jul 2005 14:06:07 GMT Received: from willers.employees.org (192.83.249.36) by sj-inbound-d.cisco.com with ESMTP; 05 Jul 2005 07:06:03 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,261,1115017200"; d="scan'208"; a="88837583:sNHT17186636" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id C01435C7FD; Tue, 5 Jul 2005 07:05:50 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-2.cisco.com (sj-iport-2-in.cisco.com [171.71.176.71]) by willers.employees.org (Postfix) with ESMTP id 43A0B5C7A8 for ; Tue, 5 Jul 2005 07:00:41 -0700 (PDT) Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-2.cisco.com with ESMTP; 05 Jul 2005 07:00:41 -0700 Received: from sjc-xdm1.cisco.com (sjc-xdm1.cisco.com [171.71.162.58]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j65E0evN025870 for ; Tue, 5 Jul 2005 07:00:40 -0700 (PDT) Date: Tue, 5 Jul 2005 07:00:40 -0700 (PDT) From: Chris Lonvick To: syslog-sec@employees.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Mailman-Approved-At: Tue, 05 Jul 2005 07:05:48 -0700 Cc: Subject: [Syslog-sec] Chair Review Comments of draft-ietf-syslog-protocol-13 X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.243.13 X-OriginalArrivalTime: 05 Jul 2005 14:06:22.0120 (UTC) FILETIME=[B90ED280:01C5816A] Status: RO X-Status: X-Keywords: X-UID: 4 Hi Folks, I've done a review of draft-ietf-syslog-protocol-13 and have the following comments. I'd like to ask Rainer to incorporate them along with any other final comments and publish a new version. Once this is in the ID repository I will call for WG Last Call for two weeks. If we don't get any major issues from that then I'll submit it to the IESG with the recommendation that it be considered for publication. I'll be doing a review of syslog-transport-udp as well. References are not allowed in the Abstract. Suggest change: This document has been written with the spirit of RFC 3164 [14] in to: This document has been written with the spirit of tradition syslog in Keeping the reference in the Introduction is OK. "Conventions Used in This Document" should be: The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119. (That's how it's written in RFC 2119.) In some cases the keyword "optional" should be in uppercase in the document - like in several places in Section 7. Double dashes in Basic Pricipals are not to be used. Suggest change o Relays may send all or some of the messages that they receive to a subsequent relay or collector. They may also store -- or otherwise locally process -- some or all messages without forwarding. In those cases, they are acting as both a collector and a relay. to: o Relays may send all or some of the messages that they receive to a subsequent relay or collector. They may also store or otherwise locally process some or all messages without forwarding. In those cases, they are acting as both a collector and a relay. Also, this is not entirely clear. Perhaps it should be changed to: o Relays may send all or some of the messages that they receive to a subsequent relay or collector. They may also store or otherwise locally process some or all messages without forwarding. In the case where a receiver stores some messages and relays some messages, it is acting as both a collector and a relay. Watch the contignuity of the diagram 1 and its title. Make sure that they are not separated by a page break. The RFC editor will also watch this. In Section 6.1 "Message Length", the following paragraphs may be clearer if they are reversed: If the last SD-ELEMENT of a message is deleted, the STRUCTURED-DATA field MUST be changed to "-" to indicate empty STRUCTURED-DATA. When a receiver or initial sender truncates a message, the TRUNCATE (Section 6.2.4) field MUST be updated. In the case of a receiver, please note that this will break eventually existing digital signatures. This is irrelevant, as the truncation itself breaks the signature. So no extra harm is done by updating the TRUNCATE field. Also, the clause please note that this will break eventually existing digital signatures. should be changed to: please note that this will break message integrity checking mechanisms such as digital signatures. Would it be appropriate in Section 6.2.1 "VERSION" to describe that the VERSION field can only be changed by STANDARDS ACTIONS as defined in RFC 2434? Also, the VERSION needs to be registered with IANA and needs to be stated in the instructions to the IANA. In Section 6.2.2 "FACILITY", the value of the facility should not have commas. FACILITY is an integer in the range from 0 to 2,147,483,647. It can change to: FACILITY is an integer in the range from 0 to 2147483647. It can If diagram 1 has a title, then so should the diagram (or table) in Section 6.2.3 "SEVERITY". The list in Section 6.2.3.1 "Relation to Alarm MIB" may be better represented in a table. The table in Section 6.2.4 "TRUNCATE" should have a title. Grammar in Section 6.3.3 "SD-PARAM": MAY drop the message. It is RECOMMENDED that the receiver logs a diagnostic on reception of invalid escape sequences. should be changed to: MAY drop the message. It is RECOMMENDED that the receiver log a diagnostic message on receipt of a message with an invalid escape sequence. Section 6.3.4 "Change Control" should either be move to the IANA Considerations or be duplicated there. Once SD-IDs and PARAM-NAMEs are defined, syntax and semantics of these objects MUST NOT be altered. Should a change to an existing object be desired, a new one MUST be created and the old one remain unchanged. A slight change may make it more readable: Once SD-IDs and PARAM-NAMEs are defined, syntax and semantics of these objects MUST NOT be altered. Should a change to an existing object be desired, a new SD-ID MUST be created and the old one remain unchanged. In Section 7.3.1 "sequenceId", commas should be removed from the number. message up to a maximum value of 2,147,483,647. If that value is should be changed to: message up to a maximum value of 2147483647. If that value is Grammar in Section 8.4 In case a sender includes user-supplied data within a syslog message, it should limit the size of that data. Otherwise, an attacker may provide large data in the hope to exploit this potential weakness. should be changed to: A sender should limit the size of any user-supplied data within a syslog message. If it does not, an attacker may provide large data in hopes of exploiting a potential weakness. (Rainer may consider adding something about rate limiting here as well.) In the Instructions to IANA, it should be noted how additional SD-PARAM names are added. For example, how would one go about adding a new SD-PARAM to describe the timezone on Mars to the timeQuality SD-ID? In that case, the SD-ID is not being changed, only a new SD-PARAM is being added. The instructions to the IANA should give a table of SD-IDs and their known SD-PARAMS. SD-ID SD-PARAM timeQuality OPTIONAL tzKnown OPTIONAL isSynced OPTIONAL syncAccuracy OPTIONAL origin OPTIONAL ip OPTIONAL enterpriseId OPTIONAL software OPTIONAL swVersion OPTIONAL meta OPTIONAL sequenceId OPTIONAL sysUpTime OPTIONAL The IANA seems to like maintaining tables better than just textual registries. Thanks, Chris _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:51:57 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id C168319046 for ; Mon, 22 Aug 2005 18:51:56 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:51:56 -0500 (CDT) Received: from xbh-sjc-231.amer.cisco.com ([128.107.191.100]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 6 Jul 2005 06:04:18 -0700 Received: from ind-iport-1.cisco.com ([64.104.129.195]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 6 Jul 2005 06:04:17 -0700 Received: from india-core-1.cisco.com (64.104.129.221) by ind-iport-1.cisco.com with ESMTP; 06 Jul 2005 18:44:49 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,264,1115017200"; d="scan'208"; a="43105824:sNHT25716368" Received: from sj-inbound-d.cisco.com (sj-inbound-d.cisco.com [128.107.243.13]) by india-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j66D22bb009284; Wed, 6 Jul 2005 13:03:57 GMT Received: from willers.employees.org (192.83.249.36) by sj-inbound-d.cisco.com with ESMTP; 06 Jul 2005 06:03:41 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,264,1115017200"; d="scan'208"; a="89213979:sNHT16843684" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id DA3585C766; Wed, 6 Jul 2005 06:03:35 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-5.cisco.com (sj-iport-5.cisco.com [171.68.10.87]) by willers.employees.org (Postfix) with ESMTP id 1EC445C757 for ; Wed, 6 Jul 2005 06:03:08 -0700 (PDT) Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-5.cisco.com with ESMTP; 06 Jul 2005 06:03:08 -0700 X-IronPort-AV: i="3.93,264,1115017200"; d="scan'208"; a="196627316:sNHT26637268" Received: from sjc-xdm1.cisco.com (sjc-xdm1.cisco.com [171.71.162.58]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j66D366q022705 for ; Wed, 6 Jul 2005 06:03:07 -0700 (PDT) Date: Wed, 6 Jul 2005 06:03:06 -0700 (PDT) From: Chris Lonvick To: syslog-sec@employees.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Mailman-Approved-At: Wed, 06 Jul 2005 06:03:34 -0700 Cc: Subject: [Syslog-sec] Chair Review Comments of draft-ietf-syslog-transport-udp-04.txt X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.243.13 X-OriginalArrivalTime: 06 Jul 2005 13:04:17.0942 (UTC) FILETIME=[37B01B60:01C5822B] Status: RO X-Status: X-Keywords: X-UID: 5 Hi Folks, My review comments of draft-ietf-syslog-transport-udp-04.txt. I'll ask Anton to address them and submit a new ID. Once that's in we can move into WG Last Call. Thanks, Chris === The dates need updating. Copyright should be dated 2005. Spaces are needed before the reference bracket. The informational RFC 3164[7] originally described the syslog should be The informational RFC 3164 [7] originally described the syslog The following paragraph is part of the Introduction but should be in a separate section "Conventions Used in This Document". The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119[5]. The words 'byte' and 'octet' are used interchangeably in this specification. The last sentence should be a separate paragraph. Section 2 "One Message Per Datagram" contains: Each syslog UDP datagram MUST contain one and only one syslog message. The message MUST be formatted according to the RFC- protocol[2]. Additional data MUST NOT be present in the datagram payload. Doesn't this go against the rules of fragmentation where a single udp datagram may contain less than one syslog message? (I know what Anton is trying to say here but I don't think it's coming out exactly right.) Section 7 "UDP Checksums" needs to have the cases of keywords changed. Use of UDP checksums was defined as optional in RFC 768[1]. IPv6 has subsequently made UDP checksums required in RFC 2460[4]. Should be Use of UDP checksums was defined as OPTIONAL in RFC 768 [1]. IPv6 has subsequently made UDP checksums REQUIRED in RFC 2460 [4]. Also, there seems to be a problem with this. It seems to state that sending IPv4 hosts don't have to send accurate udp checksums but that recieveing IPv4 hosts must discard datagrams with inaccurate udp checksums. Use of UDP checksums was defined as optional in RFC 768[1]. and Syslog senders SHOULD use UDP checksums when sending messages over IPv4. but then Syslog receivers MUST check the checksums whenever they are present and discard messages with incorrect checksums. Can we get this addressed? (Probably the section should say that it is RECOMMENDED that both senders and receivers use the checksums. It's probably worth a comment in the Security Considerations section as well.) Grammar in Section 8.2 "Message Corruption" implementation itself. For example, several earlier UDP implementations defaulted to a buffer size of less than 65536 bytes and truncated larger payloads upon reception [9]. By following the The last sentece should be: and truncated larger payloads upon receipt [9]. By following the === _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:51:57 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 386D119046 for ; Mon, 22 Aug 2005 18:51:57 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:51:57 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 7 Jul 2005 07:45:04 -0700 Received: from sj-iport-4.cisco.com ([171.68.10.86]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 7 Jul 2005 07:45:03 -0700 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-4.cisco.com with ESMTP; 07 Jul 2005 07:44:59 -0700 Received: from sj-inbound-c.cisco.com (sj-inbound-c.cisco.com [128.107.234.206]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j67Eif6t001813; Thu, 7 Jul 2005 07:44:50 -0700 (PDT) Received: from willers.employees.org (192.83.249.36) by sj-inbound-c.cisco.com with ESMTP; 07 Jul 2005 07:44:32 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,270,1115017200"; d="scan'208"; a="79087621:sNHT20063936" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id B77EB5C7E5; Thu, 7 Jul 2005 07:43:00 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from ipx10102.ipxserver.de (mailin.adiscon.com [80.190.240.92]) by willers.employees.org (Postfix) with ESMTP id 96D3F5C7DA for ; Thu, 7 Jul 2005 07:42:47 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by ipx10102.ipxserver.de (Postfix) with ESMTP id 2B9C21B00EE for ; Thu, 7 Jul 2005 16:42:47 +0200 (CEST) Received: from ipx10102.ipxserver.de ([127.0.0.1]) by localhost (ipx10102 [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 10375-02 for ; Thu, 7 Jul 2005 16:42:41 +0200 (CEST) Received: from fmint2.intern.adiscon.com (pD95B68D5.dip0.t-ipconnect.de [217.91.104.213]) by ipx10102.ipxserver.de (Postfix) with ESMTP id 9AFA61B005E for ; Thu, 7 Jul 2005 16:42:40 +0200 (CEST) Received: from grfint2.intern.adiscon.com ([172.19.0.6]) by fmint2.intern.adiscon.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 7 Jul 2005 16:42:33 +0200 Content-class: urn:content-classes:message Subject: RE: [Syslog-sec] Chair Review Comments of draft-ietf-syslog-protocol-13 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Thu, 7 Jul 2005 16:42:31 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Message-ID: <577465F99B41C842AAFBE9ED71E70ABA0E3564@grfint2.intern.adiscon.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Syslog-sec] Chair Review Comments of draft-ietf-syslog-protocol-13 Thread-Index: AcWBarzzZ6iP959DS8+QcFxVi37IngA3uYSw From: "Rainer Gerhards" To: X-OriginalArrivalTime: 07 Jul 2005 14:42:33.0588 (UTC) FILETIME=[1C2E0B40:01C58302] X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at adiscon.com Cc: X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.234.206 Status: RO X-Status: X-Keywords: X-UID: 6 Hi Chris & all, thanks for the comments. I have integrated them. While doing so, some points were raised. I would appreciate if you could go through my reply below. There are some question in it. I have also added comments related to Didier's posting on message truncation. They are at the end of this posting. I will hold the protocol-14 update to see if I receive some replies to this posting. If I hear nothing, I will post on monday.=20 Sorry this has become a large posting, but I would prefer to get some feedback before I post the next release (given the fact we are close to final call). Rainer > -----Original Message----- > From: syslog-sec-bounces@www.employees.org=20 > [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of=20 > Chris Lonvick > Sent: Tuesday, July 05, 2005 4:01 PM > To: syslog-sec@employees.org > Subject: [Syslog-sec] Chair Review Comments of=20 > draft-ietf-syslog-protocol-13 >=20 > Hi Folks, >=20 > I've done a review of draft-ietf-syslog-protocol-13 and have=20 > the following > comments. I'd like to ask Rainer to incorporate them along=20 > with any other > final comments and publish a new version. Once this is in the ID > repository I will call for WG Last Call for two weeks. If we=20 > don't get > any major issues from that then I'll submit it to the IESG with the > recommendation that it be considered for publication. I'll be doing a > review of syslog-transport-udp as well. >=20 >=20 >=20 > References are not allowed in the Abstract. Suggest change: > This document has been written with the spirit of RFC 3164 [14] in > to: > This document has been written with the spirit of=20 > tradition syslog in > Keeping the reference in the Introduction is OK. done >=20 >=20 > "Conventions Used in This Document" should be: > The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL > NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and > "OPTIONAL" in this document are to be interpreted as=20 > described in > RFC 2119. > (That's how it's written in RFC 2119.) In some cases the keyword > "optional" should be in uppercase in the document - like in=20 > several places > in Section 7. >=20 done (including section 7) >=20 > Double dashes in Basic Pricipals are not to be used. Suggest change > o Relays may send all or some of the messages that they=20 > receive to a > subsequent relay or collector. They may also store -- or > otherwise locally process -- some or all messages without > forwarding. In those cases, they are acting as both a collector > and a relay. > to: > o Relays may send all or some of the messages that they=20 > receive to a > subsequent relay or collector. They may also store or otherwise > locally process some or all messages without=20 > forwarding. In those > cases, they are acting as both a collector and a relay. > Also, this is not entirely clear. Perhaps it should be changed to: > o Relays may send all or some of the messages that they=20 > receive to a > subsequent relay or collector. They may also store or otherwise > locally process some or all messages without forwarding. In the > case where a receiver stores some messages and relays some > messages, it is acting as both a collector and a relay. >=20 changed to the text you suggested (directly above this sentence) >=20 > Watch the contignuity of the diagram 1 and its title. Make sure that > they are not separated by a page break. The RFC editor will also > watch this. I needed to squeze it a little, but I think it is still readable well enough. Don't like the idea to drop one of the scenarios... >=20 >=20 > In Section 6.1 "Message Length", the following paragraphs may=20 > be clearer > if they are reversed: > If the last SD-ELEMENT of a message is deleted, the STRUCTURED-DATA > field MUST be changed to "-" to indicate empty STRUCTURED-DATA. >=20 > When a receiver or initial sender truncates a message, the TRUNCATE > (Section 6.2.4) field MUST be updated. In the case of a receiver, > please note that this will break eventually existing digital > signatures. This is irrelevant, as the truncation itself=20 > breaks the > signature. So no extra harm is done by updating the=20 > TRUNCATE field. > Also, the clause > please note that this will break eventually existing digital > signatures. > should be changed to: > please note that this will break message integrity checking > mechanisms such as digital signatures. >=20 done >=20 > Would it be appropriate in Section 6.2.1 "VERSION" to describe that > the VERSION field can only be changed by STANDARDS ACTIONS as defined > in RFC 2434? Also, the VERSION needs to be registered with=20 > IANA and needs > to be stated in the instructions to the IANA. I've changed it to "Standards Action" in 9.1. Do you think I actually need to repeat this in 6.2.1? Does 9.2 also require "Standards Action" or is "Specification Required" (as it is currently) sufficient? I am a bit in doubt, maybe it's better to keep this consistent. >=20 >=20 > In Section 6.2.2 "FACILITY", the value of the facility should not > have commas. > FACILITY is an integer in the range from 0 to=20 > 2,147,483,647. It can > change to: > FACILITY is an integer in the range from 0 to 2147483647. It can done >=20 >=20 > If diagram 1 has a title, then so should the diagram (or=20 > table) in Section > 6.2.3 "SEVERITY". >=20 done >=20 > The list in Section 6.2.3.1 "Relation to Alarm MIB" may be better > represented in a table. I have changed the layout and included Sharon's latest comment on the mappings. I hope the mapping is now acceptable to all. The new text is as follows: ### 6.2.3.1 Relation to Alarm MIB The Alarm MIB RFC3877 [11] defines ITU perceived severities which are useful to be able to relate to the syslog severities, particularly in the case where alarms are being logged. The ITUPerceivedSeverity corresponds to a syslog SEVERITY as shown in table 2 below. ITU Perceivedi Severity syslog SEVERITY Critical Alert Major Critical Minor Error Warning Warning Indeterminate Notice Cleared Notice Table 2. ITUPerceivedSeverity to syslog SEVERITY mapping. ### >=20 >=20 > The table in Section 6.2.4 "TRUNCATE" should have a title. done >=20 >=20 > Grammar in Section 6.3.3 "SD-PARAM": > MAY drop the message. It is RECOMMENDED that the receiver logs a > diagnostic on reception of invalid escape sequences. > should be changed to: > MAY drop the message. It is RECOMMENDED that the receiver log a > diagnostic message on receipt of a message with an invalid escape > sequence. done >=20 >=20 > Section 6.3.4 "Change Control" should either be move to the IANA > Considerations or be duplicated there. > Once SD-IDs and PARAM-NAMEs are defined, syntax and semantics of > these objects MUST NOT be altered. Should a change to an existing > object be desired, a new one MUST be created and the old one remain > unchanged. > A slight change may make it more readable: > Once SD-IDs and PARAM-NAMEs are defined, syntax and semantics of > these objects MUST NOT be altered. Should a change to an existing > object be desired, a new SD-ID MUST be created and the old=20 > one remain > unchanged. >=20 done with a slight change: ### a new SD-ID or PARAM-NAME MUST be created and the old one remain unchanged. ### duplicated to IANA considerations, but mentioning only SD-IDs there. Which brings up the question: must we put PARAM-Names under IANA-Control, too? It kind of looks so... >=20 > In Section 7.3.1 "sequenceId", commas should be removed from=20 > the number. > message up to a maximum value of 2,147,483,647. If that value is > should be changed to: > message up to a maximum value of 2147483647. If that value is done >=20 >=20 > Grammar in Section 8.4 > In case a sender includes user-supplied data within a=20 > syslog message, > it should limit the size of that data. Otherwise, an attacker may > provide large data in the hope to exploit this potential weakness. > should be changed to: > A sender should limit the size of any user-supplied data within a > syslog message. If it does not, an attacker may provide=20 > large data in > hopes of exploiting a potential weakness. done > (Rainer may consider adding something about rate limiting=20 > here as well.) I have included some information on rate limiting a bit later, in 8.6. The suggested text is: ### 8.6 Reliable Delivery Because there is no mechanism described within this document to ensure delivery, and the underlying transport may be unreliable (e.g., UDP), some messages may be lost. They may either be dropped through network congestion, or they may be maliciously intercepted and discarded. The consequences of dropping one or more syslog messages cannot be determined. If the messages are simple status updates, then their non-receipt may either not be noticed, or it may cause an annoyance for the system operators. On the other hand, if the messages are more critical, then the administrators may not become aware of a developing and potentially serious problem. Messages may also be intercepted and discarded by an attacker as a way to hide unauthorized activities. It may be desirable to use a transport with guaranteed delivery, to mitigate congestion. It may also be desirable to include rate-limiting features in syslog senders. This can reduce potential congestion problems when message bursts happen. ### I think talking about rate-limiting on the receiver's side does not make so much sense, as it will result in message loss in any case (at least with UDP transport). Do you think the proposed text is OK? >=20 >=20 > In the Instructions to IANA, it should be noted how additional > SD-PARAM names are added. For example, how would one go about adding > a new SD-PARAM to describe the timezone on Mars to the timeQuality > SD-ID? In that case, the SD-ID is not being changed, only a=20 > new SD-PARAM > is being added. I have changed the text to cover this: ### 9.2 SD-IDs IANA must maintain a registry of Structured Data ID (SD-ID) values together with their associated PARAM-NAME values as described in Section 7. New SD-ID and new PARAM-NAME values may be registered through the Specification Required method as described in RFC 2434 [9]. Once SD-IDs and SD-PARAMs are defined, syntax and semantics of these objects MUST NOT be altered. Should a change to an existing object be desired, a new SD-ID or SD-PARAM MUST be created and the old one remain unchanged. IANA must register the SD-IDs and PARAM-NAMEs shown in table 4 below. ### I have also changed the SD-PARAM description: ### 6.3.3 SD-PARAM Each SD-PARAM consist of a name, referred to as PARAM-NAME, and a value, referred to as PARAM-VALUE. PARAM-NAME is case-sensitive. IANA controls all PARAM-NAMEs, with the exception of those in experimental SD-IDs. The PARAM-NAME scope is within a specific SD-ID. Thus, an equally-named PARAM-NAME contained in two different SD-IDs is not the same. ### However, this raises a question: should we allow experimental SD-PARAMs in standardized SD-IDs? Or should these only be allowed in experimental SD-IDs (x-)? >=20 >=20 > The instructions to the IANA should give a table of SD-IDs and their > known SD-PARAMS. > SD-ID SD-PARAM >=20 > timeQuality OPTIONAL > tzKnown OPTIONAL > isSynced OPTIONAL > syncAccuracy OPTIONAL >=20 > origin OPTIONAL > ip OPTIONAL > enterpriseId OPTIONAL > software OPTIONAL > swVersion OPTIONAL >=20 > meta OPTIONAL > sequenceId OPTIONAL > sysUpTime OPTIONAL >=20 > The IANA seems to like maintaining tables better than just textual > registries. >=20 Chris, I am not sure if the "must" below must be in upper case (as it is no protocol related thing). I'd appreciate your advise: ### IANA must register the SD-IDs shown in table 4 below. ### ^^^^ Regarding Didier's comments on the truncation process, I have added the following section: ### A.3 Message Truncation As outlined in Section 6.1, messages may be subject to truncation. In this case, the TRUNCATE field must be updated as specified in Section 6.2.4. Implementors must keep in mind that the TRUNCATE field is a variable-sized entity. Thus, its size requirement (in octets) may grow during truncation. For example, if a relay truncates the MSG part of a message previously not truncated, the TRUNCATE field value changes from 0 to 10, taking up one additional octet of space. As such, it is necessary to truncate one additional octet from the MSG to make room for the now-expanded HEADER. Similar reformatting may be necessary if a relay is operator- instructed to perform header modifications, e.g. to change the FACILITY or SEVERITY of a message before forwarding it. ### I have also changed the values of the TRUNCATE bits to something that I think making it less likely to grow: ### 6.2.4 TRUNCATE The TRUNCATE field is used to indicate if the message has been truncated since it was sent or generated by an application. Such a truncation might happen on the initial sender and any receiver, including receivers on interim systems (relays). Values in the TRUNCATE field are made up of bits. Each of this bits has been assigned a specific value so that there is no doubt about bit ordering. The values described in table 3 below MUST be used. VALUE Meaning 1 all or some SD-ELEMENTs were truncated 2 all or part of MSG was truncated 4 truncation occurred at the receiver 8 truncation occurred at an interim system 16 truncation occurred at the initial sender Table 3. TRUNCATE values. ### _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From aokmians@cisco.com Mon Aug 22 18:51:58 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id E162619046 for ; Mon, 22 Aug 2005 18:51:57 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:51:57 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 6 Jul 2005 07:36:01 -0700 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----_=_NextPart_001_01C58238.07C41E80" Received: from xbh-rtp-211.amer.cisco.com ([64.102.31.102]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 6 Jul 2005 07:36:01 -0700 Received: from xmb-rtp-20d.amer.cisco.com ([64.102.31.51]) by xbh-rtp-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 6 Jul 2005 10:36:00 -0400 Content-class: urn:content-classes:message X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 X-OriginalArrivalTime: 06 Jul 2005 14:36:00.0386 (UTC) FILETIME=[07666E20:01C58238] Subject: RE: [Syslog-sec] Chair Review Comments ofdraft-ietf-syslog-transport-udp-04.txt Date: Wed, 6 Jul 2005 07:35:59 -0700 Message-ID: <98AE08B66FAD1742BED6CB9522B731224771D2@xmb-rtp-20d.amer.cisco.com> X-MS-Has-Attach: yes X-MS-TNEF-Correlator: Thread-Topic: [Syslog-sec] Chair Review Comments ofdraft-ietf-syslog-transport-udp-04.txt Thread-Index: AcWCKz1P4Qba9EggTfO8F4oMwmIhaAAC6Ucw From: "Anton Okmianski (aokmians)" To: "Chris Lonvick (clonvick)" , Status: RO X-Status: X-Keywords: X-UID: 7 This is a multi-part message in MIME format. ------_=_NextPart_001_01C58238.07C41E80 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Chris: Thanks for feedback. Attached is the latest draft for final review by = the group before I send it out officially. One follow up question = below... =20 > The dates need updating. Copyright should be dated 2005. Done. > Spaces are needed before the reference bracket. > The informational RFC 3164[7] originally described the=20 > syslog should be > The informational RFC 3164 [7] originally described the syslog Done.=20 > The following paragraph is part of the Introduction but=20 > should be in a separate section "Conventions Used in This Document". > The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", > "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and=20 > "OPTIONAL" in this > document are to be interpreted as described in RFC 2119[5]. The > words 'byte' and 'octet' are used interchangeably in this > specification. > The last sentence should be a separate paragraph. Done. > Section 2 "One Message Per Datagram" contains: > Each syslog UDP datagram MUST contain one and only one syslog > message. The message MUST be formatted according to the RFC- > protocol[2]. Additional data MUST NOT be present in the datagram > payload. > Doesn't this go against the rules of fragmentation where a=20 > single udp datagram may contain less than one syslog message?=20 > (I know what Anton is trying to say here but I don't think=20 > it's coming out exactly right.) I changed this to: "Each syslog UDP datagram MUST contain only one syslog message, which can be complete or truncated. The message MUST be formatted and truncated according to the RFC-protocol [2]. Additional data MUST NOT be present in the datagram payload." Does this look ok? > Section 7 "UDP Checksums" needs to have the cases of keywords changed. > Use of UDP checksums was defined as optional in RFC=20 > 768[1]. IPv6 has > subsequently made UDP checksums required in RFC 2460[4]. > Should be > Use of UDP checksums was defined as OPTIONAL in RFC 768=20 > [1]. IPv6 has > subsequently made UDP checksums REQUIRED in RFC 2460 [4]. Done. > Also, there seems to be a problem with this. > It seems to state that sending IPv4 hosts don't have to send=20 > accurate udp checksums but that recieveing IPv4 hosts must=20 > discard datagrams with inaccurate udp checksums. This is correct. I don't see a problem with that. There is a way to = distinguish accurate checksum from one that was not computed at all. =20 > Use of UDP checksums was defined as optional in RFC 768[1]. > and > Syslog senders SHOULD use UDP checksums when sending > messages over IPv4. > but then > Syslog receivers MUST check the checksums whenever they are present > and discard messages with incorrect checksums. As stated in the last sentence, the receivers must only check the = checksums whenever they are present. So, if the checksum is 0, it = indicates the sender did not compute the checksum per UDP RFC. In this = case, we do not require the receiver to discard the message. But if = checksums are there, the receiver MUST validate them.=20 > Can we get this addressed? (Probably the section should say=20 > that it is RECOMMENDED that both senders and receivers use=20 > the checksums. It's probably worth a comment in the Security=20 > Considerations section as well.) I could go for that, it you still think it is needed. Or could just = clarify the requirement further. However, I think given a requirement = on Internet hosts to support UDP checksums (if not always enabled), it = is a good idea to take advantage of that feature for syslog to ensure = better robustness. What do you think? > Grammar in Section 8.2 "Message Corruption" > implementation itself. For example, several earlier UDP > implementations defaulted to a buffer size of less than 65536 bytes > and truncated larger payloads upon reception [9]. By=20 > following the The last sentece should be: > and truncated larger payloads upon receipt [9]. By following the Done. Thanks, Anton. ------_=_NextPart_001_01C58238.07C41E80 Content-Type: text/plain; name="draft-ietf-syslog-transport-udp-05.txt" Content-Transfer-Encoding: base64 Content-Description: draft-ietf-syslog-transport-udp-05.txt Content-Disposition: attachment; filename="draft-ietf-syslog-transport-udp-05.txt" CgoKCnN5c2xvZyBXb3JraW5nIEdyb3VwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIEEuIE9rbWlhbnNraQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIENpc2NvIFN5c3RlbXMsIEluYy4KRXhwaXJlczogSmFudWFyeSA3LCAy MDA2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVseSA2LCAyMDA1CgoKICAg ICAgICAgICAgICAgIFRyYW5zbWlzc2lvbiBvZiBzeXNsb2cgbWVzc2FnZXMgb3ZlciBVRFAKICAg ICAgICAgICAgICAgICAgIGRyYWZ0LWlldGYtc3lzbG9nLXRyYW5zcG9ydC11ZHAtMDUKClN0YXR1 cyBvZiB0aGlzIE1lbW8KCiAgIFRoaXMgZG9jdW1lbnQgaXMgYW4gSW50ZXJuZXQtRHJhZnQgYW5k IGlzIHN1YmplY3QgdG8gYWxsIHByb3Zpc2lvbnMKICAgb2YgU2VjdGlvbiAzIG9mIFJGQyAzNjY3 LiAgQnkgc3VibWl0dGluZyB0aGlzIEludGVybmV0LURyYWZ0LCBlYWNoCiAgIGF1dGhvciByZXBy ZXNlbnRzIHRoYXQgYW55IGFwcGxpY2FibGUgcGF0ZW50IG9yIG90aGVyIElQUiBjbGFpbXMgb2YK ICAgd2hpY2ggaGUgb3Igc2hlIGlzIGF3YXJlIGhhdmUgYmVlbiBvciB3aWxsIGJlIGRpc2Nsb3Nl ZCwgYW5kIGFueSBvZgogICB3aGljaCBoZSBvciBzaGUgYmVjb21lIGF3YXJlIHdpbGwgYmUgZGlz Y2xvc2VkLCBpbiBhY2NvcmRhbmNlIHdpdGgKICAgUkZDIDM2NjguCgogICBJbnRlcm5ldC1EcmFm dHMgYXJlIHdvcmtpbmcgZG9jdW1lbnRzIG9mIHRoZSBJbnRlcm5ldCBFbmdpbmVlcmluZwogICBU YXNrIEZvcmNlIChJRVRGKSwgaXRzIGFyZWFzLCBhbmQgaXRzIHdvcmtpbmcgZ3JvdXBzLiAgTm90 ZSB0aGF0CiAgIG90aGVyIGdyb3VwcyBtYXkgYWxzbyBkaXN0cmlidXRlIHdvcmtpbmcgZG9jdW1l bnRzIGFzIEludGVybmV0LQogICBEcmFmdHMuCgogICBJbnRlcm5ldC1EcmFmdHMgYXJlIGRyYWZ0 IGRvY3VtZW50cyB2YWxpZCBmb3IgYSBtYXhpbXVtIG9mIHNpeCBtb250aHMKICAgYW5kIG1heSBi ZSB1cGRhdGVkLCByZXBsYWNlZCwgb3Igb2Jzb2xldGVkIGJ5IG90aGVyIGRvY3VtZW50cyBhdCBh bnkKICAgdGltZS4gIEl0IGlzIGluYXBwcm9wcmlhdGUgdG8gdXNlIEludGVybmV0LURyYWZ0cyBh cyByZWZlcmVuY2UKICAgbWF0ZXJpYWwgb3IgdG8gY2l0ZSB0aGVtIG90aGVyIHRoYW4gYXMgIndv cmsgaW4gcHJvZ3Jlc3MuIgoKICAgVGhlIGxpc3Qgb2YgY3VycmVudCBJbnRlcm5ldC1EcmFmdHMg Y2FuIGJlIGFjY2Vzc2VkIGF0CiAgIGh0dHA6Ly93d3cuaWV0Zi5vcmcvaWV0Zi8xaWQtYWJzdHJh Y3RzLnR4dC4KCiAgIFRoZSBsaXN0IG9mIEludGVybmV0LURyYWZ0IFNoYWRvdyBEaXJlY3Rvcmll cyBjYW4gYmUgYWNjZXNzZWQgYXQKICAgaHR0cDovL3d3dy5pZXRmLm9yZy9zaGFkb3cuaHRtbC4K CiAgIFRoaXMgSW50ZXJuZXQtRHJhZnQgd2lsbCBleHBpcmUgb24gSmFudWFyeSA3LCAyMDA2LgoK Q29weXJpZ2h0IE5vdGljZQoKICAgQ29weXJpZ2h0IChDKSBUaGUgSW50ZXJuZXQgU29jaWV0eSAo MjAwNSkuCgpBYnN0cmFjdAoKICAgVGhpcyBkb2N1bWVudCBkZXNjcmliZXMgdGhlIHRyYW5zcG9y dCBmb3Igc3lzbG9nIG1lc3NhZ2VzIG92ZXIgVURQLwogICBJUHY0IG9yIFVEUC9JUHY2LiAgVGhl IHN5c2xvZyBwcm90b2NvbCBsYXllcmVkIGFyY2hpdGVjdHVyZSBwcm92aWRlcwogICBmb3Igc3Vw cG9ydCBvZiBhbnkgbnVtYmVyIG9mIHRyYW5zcG9ydCBtYXBwaW5ncy4gIEhvd2V2ZXIsIGZvcgog ICBpbnRlcm9wZXJhYmlsaXR5IHB1cnBvc2VzLCBzeXNsb2cgcHJvdG9jb2wgaW1wbGVtZW50b3Jz IGFyZSByZXF1aXJlZAogICB0byBzdXBwb3J0IHRoaXMgdHJhbnNwb3J0IHByb3RvY29sLgoKCgoK Ck9rbWlhbnNraSAgICAgICAgICAgICAgICBFeHBpcmVzIEphbnVhcnkgNywgMjAwNiAgICAgICAg ICAgICAgICBbUGFnZSAxXQoMCkludGVybmV0LURyYWZ0ICAgICAgICAgICAgc3lzbG9nIHVkcCB0 cmFuc3BvcnQgICAgICAgICAgICAgICAgIEp1bHkgMjAwNQoKClRhYmxlIG9mIENvbnRlbnRzCgog ICAxLiAgIEludHJvZHVjdGlvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAgIDMKICAgMi4gICBDb252ZW50aW9ucyBVc2VkIGluIFRoaXMgRG9jdW1lbnQg IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICAzCiAgIDMuICAgT25lIE1lc3NhZ2UgUGVyIERh dGFncmFtIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgMwogICA0LiAgIE1l c3NhZ2UgU2l6ZSAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAgIDMKICAgNS4gICBTb3VyY2UgYW5kIFRhcmdldCBQb3J0cyAgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gICA0CiAgIDYuICAgU291cmNlIElQIEFkZHJlc3MgIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgNAogICA3LiAgIFVEUC9JUCBTdHJ1 Y3R1cmUgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDQKICAg OC4gICBVRFAgQ2hlY2tzdW1zICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gICA0CiAgIDkuICAgUmVsaWFiaWxpdHkgQ29uc2lkZXJhdGlvbnMgLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgNQogICAgIDkuMSAgTG9zdCBEYXRhZ3JhbXMgLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDUKICAgICA5LjIgIE1l c3NhZ2UgQ29ycnVwdGlvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g ICA1CiAgICAgOS4zICBDb25nZXN0aW9uIENvbnRyb2wgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuICAgNQogICAgIDkuNCAgU2VxdWVuY2VkIERlbGl2ZXJ5IC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDYKICAgMTAuICBTZWN1cml0eSBDb25z aWRlcmF0aW9ucyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICA2CiAgICAg MTAuMSAgIFNlbmRlciBBdXRoZW50aWNhdGlvbiAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuICAgNgogICAgIDEwLjIgICBNZXNzYWdlIEZvcmdlcnkgIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDYKICAgICAxMC4zICAgTWVzc2FnZSBPYnNlcnZhdGlv biAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICA3CiAgICAgMTAuNCAgIFJl cGxheWluZyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAg NwogICAgIDEwLjUgICBVbnJlbGlhYmxlIERlbGl2ZXJ5ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAgIDcKICAgICAxMC42ICAgTWVzc2FnZSBQcmlvcml0aXphdGlvbiBhbmQg RGlmZmVyZW50aWF0aW9uIC4gLiAuIC4gLiAuIC4gICA3CiAgICAgMTAuNyAgIERlbmlhbCBvZiBT ZXJ2aWNlICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgOAogICAxMS4g IElBTkEgQ29uc2lkZXJhdGlvbnMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAgIDgKICAgMTIuICBOb3RpY2UgdG8gUkZDIEVkaXRvciAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gICA4CiAgIDEzLiAgV29ya2luZyBHcm91cCAgLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgOAogICAxNC4gIEFja25vd2xl ZGdlbWVudHMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDgK ICAgMTUuICBSZWZlcmVuY2VzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gICA5CiAgICAgMTUuMSAgIE5vcm1hdGl2ZSBSZWZlcmVuY2VzIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgOQogICAgIDE1LjIgICBJbmZvcm1hdGl2ZSBS ZWZlcmVuY2VzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDkKICAgICAgICBB dXRob3IncyBBZGRyZXNzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gICA5CiAgICAgICAgSW50ZWxsZWN0dWFsIFByb3BlcnR5IGFuZCBDb3B5cmlnaHQgU3RhdGVt ZW50cyAuIC4gLiAuIC4gLiAuICAxMAoKCgoKCgoKCgoKCgoKCgoKCgoKT2ttaWFuc2tpICAgICAg ICAgICAgICAgIEV4cGlyZXMgSmFudWFyeSA3LCAyMDA2ICAgICAgICAgICAgICAgIFtQYWdlIDJd CgwKSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICBzeXNsb2cgdWRwIHRyYW5zcG9ydCAgICAgICAg ICAgICAgICAgSnVseSAyMDA1CgoKMS4gIEludHJvZHVjdGlvbgoKICAgVGhlIGluZm9ybWF0aW9u YWwgUkZDIDMxNjQgWzddIG9yaWdpbmFsbHkgZGVzY3JpYmVkIHRoZSBzeXNsb2cKICAgcHJvdG9j b2wgYXMgaXQgd2FzIG9ic2VydmVkIGluIGV4aXN0aW5nIGltcGxlbWVudGF0aW9ucy4gIEl0CiAg IGRlc2NyaWJlZCBib3RoIHRoZSBmb3JtYXQgb2Ygc3lzbG9nIG1lc3NhZ2VzIGFuZCBhIFVEUCBb MV0gdHJhbnNwb3J0LgogICBTdWJzZXF1ZW50bHksIHRoZSBzeXNsb2cgcHJvdG9jb2wgaGFzIGJl ZW4gZm9ybWFsbHkgZGVmaW5lZCBpbiB0aGUKICAgc3RhbmRhcmRzIHRyYWNrIFJGQy1wcm90b2Nv bCBbMl0uCgogICBUaGUgUkZDLXByb3RvY29sIHNwZWNpZmllZCBhIGxheWVyZWQgYXJjaGl0ZWN0 dXJlIHRoYXQgcHJvdmlkZWQgZm9yCiAgIHN1cHBvcnQgb2YgYW55IG51bWJlciBvZiB0cmFuc3Bv cnQgbGF5ZXIgcHJvdG9jb2xzIGZvciB0cmFuc21pdHRpbmcKICAgc3lzbG9nIG1lc3NhZ2VzLiAg VGhpcyBzdGFuZGFyZHMgdHJhY2sgUkZDIGRlc2NyaWJlcyB0aGUgVURQCiAgIHRyYW5zcG9ydCBm b3IgdGhlIHN5c2xvZyBwcm90b2NvbC4KCiAgIFRoaXMgcHJvdG9jb2wgY2FuIGJlIHVzZWQgZm9y IHRyYW5zbWl0dGluZyBzeXNsb2cgbWVzc2FnZXMgb3ZlciBib3RoCiAgIElQdjQgWzNdIGFuZCBJ UHY2IFs0XS4gIFRoaXMgdHJhbnNwb3J0IHByb3RvY29sIGlzIFJFUVVJUkVEIGZvciBhbGwKICAg c3lzbG9nIHByb3RvY29sIGltcGxlbWVudGF0aW9ucyBmb3IgaW50ZXJvcGVyYWJpbGl0eSBwdXJw b3Nlcy4KCiAgIE5ldHdvcmsgYWRtaW5pc3RyYXRvcnMgYW5kIGFyY2hpdGVjdHMgc2hvdWxkIGJl IGF3YXJlIG9mIHRoZQogICBzaWduaWZpY2FudCByZWxpYWJpbGl0eSBhbmQgc2VjdXJpdHkgaXNz dWVzIG9mIHRoaXMgcHJvdG9jb2wsIHdoaWNoCiAgIHN0ZW0gZnJvbSB0aGUgdXNlIG9mIFVEUC4g IFRoZXkgYXJlIGRvY3VtZW50ZWQgaW4gdGhpcyBzcGVjaWZpY2F0aW9uLgogICBIb3dldmVyLCB0 aGlzIHByb3RvY29sIGlzIGxpZ2h0d2VpZ2h0IGFuZCBpcyBidWlsdCB1cG9uIHRoZSBleGlzdGlu ZwogICBwb3B1bGFyIHVzZSBvZiBVRFAgZm9yIHN5c2xvZy4KCjIuICBDb252ZW50aW9ucyBVc2Vk IGluIFRoaXMgRG9jdW1lbnQKCiAgIFRoZSBrZXkgd29yZHMgIk1VU1QiLCAiTVVTVCBOT1QiLCAi UkVRVUlSRUQiLCAiU0hBTEwiLCAiU0hBTEwgTk9UIiwKICAgIlNIT1VMRCIsICJTSE9VTEQgTk9U IiwgIlJFQ09NTUVOREVEIiwgIk1BWSIsIGFuZCAiT1BUSU9OQUwiIGluIHRoaXMKICAgZG9jdW1l bnQgYXJlIHRvIGJlIGludGVycHJldGVkIGFzIGRlc2NyaWJlZCBpbiBSRkMgMjExOSBbNV0uCgog ICBUaGUgd29yZHMgJ2J5dGUnIGFuZCAnb2N0ZXQnIGFyZSB1c2VkIGludGVyY2hhbmdlYWJseSBp biB0aGlzCiAgIGRvY3VtZW50LgoKMy4gIE9uZSBNZXNzYWdlIFBlciBEYXRhZ3JhbQoKICAgRWFj aCBzeXNsb2cgVURQIGRhdGFncmFtIE1VU1QgY29udGFpbiBvbmx5IG9uZSBzeXNsb2cgbWVzc2Fn ZSwgd2hpY2gKICAgY2FuIGJlIGNvbXBsZXRlIG9yIHRydW5jYXRlZC4gIFRoZSBtZXNzYWdlIE1V U1QgYmUgZm9ybWF0dGVkIGFuZAogICB0cnVuY2F0ZWQgYWNjb3JkaW5nIHRvIHRoZSBSRkMtcHJv dG9jb2wgWzJdLiAgQWRkaXRpb25hbCBkYXRhIE1VU1QKICAgTk9UIGJlIHByZXNlbnQgaW4gdGhl IGRhdGFncmFtIHBheWxvYWQuCgo0LiAgTWVzc2FnZSBTaXplCgogICBUaGlzIHByb3RvY29sIHN1 cHBvcnRzIHRyYW5zbWlzc2lvbiBvZiBzeXNsb2cgbWVzc2FnZXMgdXAgdG8gNjU1MzYKICAgYnl0 ZXMgaW4gc2l6ZS4gIFRoaXMgbGltaXQgc3RlbXMgZnJvbSB0aGUgbWF4aW11bSBzdXBwb3J0ZWQg VURQCiAgIHBheWxvYWQgb2YgNjU1MzYga2lsb2J5dGVzIHNwZWNpZmllZCBpbiB0aGUgUkZDIDc2 OCBbMV0uCgogICBJUHY0IHN5c2xvZyByZWNlaXZlcnMgTVVTVCBiZSBhYmxlIHRvIHJlY2VpdmUg ZGF0YWdyYW1zIHdpdGggbWVzc2FnZQogICBzaXplIHVwIHRvIGFuZCBpbmNsdWRpbmcgNDgwIGJ5 dGVzLiAgSVB2NiBzeXNsb2cgcmVjZWl2ZXJzIE1VU1QgYmUKICAgYWJsZSB0byByZWNlaXZlIGRh dGFncmFtcyB3aXRoIG1lc3NhZ2Ugc2l6ZSB1cCB0byBhbmQgaW5jbHVkaW5nIDExODAKCgoKT2tt aWFuc2tpICAgICAgICAgICAgICAgIEV4cGlyZXMgSmFudWFyeSA3LCAyMDA2ICAgICAgICAgICAg ICAgIFtQYWdlIDNdCgwKSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICBzeXNsb2cgdWRwIHRyYW5z cG9ydCAgICAgICAgICAgICAgICAgSnVseSAyMDA1CgoKICAgYnl0ZXMuICBBbGwgc3lzbG9nIHJl Y2VpdmVycyBTSE9VTEQgYmUgYWJsZSB0byByZWNlaXZlIGRhdGFncmFtcyB3aXRoCiAgIG1lc3Nh Z2VzIHNpemUgb2YgYXQgbGVhc3QgMjA0OCBieXRlcy4KCiAgIFRoZSBhYm92ZSByZXN0cmljdGlv bnMgYW5kIHJlY29tbWVuZGF0aW9ucyBlc3RhYmxpc2ggYSBiYXNlbGluZSBmb3IKICAgaW50ZXJv cGVyYWJpbGl0eS4gIFRoZSBtaW5pbXVtIHJlcXVpcmVkIG1lc3NhZ2Ugc2l6ZSBzdXBwb3J0IHdh cwogICBkZXRlcm1pbmVkIGJhc2VkIG9uIHRoZSBtaW5pbXVtIE1UVSBzaXplIHRoYXQgaW50ZXJu ZXQgaG9zdHMgYXJlCiAgIHJlcXVpcmVkIHRvIHN1cHBvcnQ6IDU3NiBieXRlcyBmb3IgSVB2NCBb M10gYW5kIDEyODAgYnl0ZXMgZm9yIElQdjYKICAgWzRdLiAgRGF0YWdyYW1zIHRoYXQgZmFsbCB3 aXRoaW4gdGhlc2UgbGltaXRzIGhhdmUgdGhlIGdyZWF0ZXN0CiAgIGNoYW5jZSBvZiBiZWluZyBk ZWxpdmVyZWQgYmVjYXVzZSB0aGV5IGRvIG5vdCByZXF1aXJlIGZyYWdtZW50YXRpb24uCgogICBJ dCBpcyBSRUNPTU1FTkRFRCB0aGF0IGFwcGxpY2F0aW9uIGRldmVsb3BlcnMgcmVzdHJpY3QgbWVz c2FnZSBzaXplcwogICBzdWNoIHRoYXQgSVAgZGF0YWdyYW1zIGRvIG5vdCBleGNlZWQgdGhlIHNt YWxsZXN0IE1UVSBvZiB0aGUgbmV0d29yawogICBpbiB1c2UuICBUaGlzIGF2b2lkcyBkYXRhZ3Jh bSBmcmFnbWVudGF0aW9uIGFuZCBwb3NzaWJsZSBpc3N1ZXMKICAgc3Vycm91bmRpbmcgZnJhZ21l bnRhdGlvbiBzdWNoIGFzIGluY29ycmVjdCBNVFUgZGlzY292ZXJ5LgogICBGcmFnbWVudGF0aW9u IG1heSBiZSB1bmRlc2lyYWJsZSBiZWNhdXNlIGl0IGluY3JlYXNlcyB0aGUgcmlzayBvZiB0aGUK ICAgbWVzc2FnZSBiZWluZyBsb3N0IGR1ZSB0byBsb3NzIG9mIGp1c3Qgb25lIGRhdGFncmFtIGZy YWdtZW50LiAgV2hlbgogICBuZXR3b3JrIE1UVSBpcyBub3Qga25vd24gaW4gYWR2YW5jZSBhbmQg Y2Fubm90IGJlIHJlbGlhYmx5IGRldGVybWluZWQKICAgdXNpbmcgcGF0aCBNVFUgZGlzY292ZXJ5 IFs4XSwgdGhlIHNhZmVzdCBhc3N1bXB0aW9uIGlzIHRvIHJlc3RyaWN0CiAgIG1lc3NhZ2VzIHRv IDQ4MCBieXRlcyBmb3IgSVB2NCBhbmQgMTE4MCBieXRlcyBmb3IgSVB2Ni4KCjUuICBTb3VyY2Ug YW5kIFRhcmdldCBQb3J0cwoKICAgU3lzbG9nIHJlY2VpdmVycyBNVVNUIHN1cHBvcnQgYWNjZXB0 aW5nIHN5c2xvZyBkYXRhZ3JhbXMgb24gYSB3ZWxsLQogICBrbm93biBVRFAgcG9ydCA1MTQsIGJ1 dCBNQVkgYmUgY29uZmlndXJhYmxlIHRvIGxpc3RlbiBvbiBhIGRpZmZlcmVudAogICBwb3J0LiAg U3lzbG9nIHNlbmRlcnMgTVVTVCBzdXBwb3J0IHNlbmRpbmcgc3lzbG9nIG1lc3NhZ2UgZGF0YWdy YW1zCiAgIHRvIHRoZSBVRFAgcG9ydCA1MTQsIGJ1dCBNQVkgYmUgY29uZmlndXJhYmxlIHRvIHNl bmQgbWVzc2FnZXMgdG8gYQogICBkaWZmZXJlbnQgcG9ydC4gIFN5c2xvZyBzZW5kZXJzIE1BWSB1 c2UgYW55IHNvdXJjZSBVRFAgcG9ydCBmb3IKICAgdHJhbnNtaXR0aW5nIG1lc3NhZ2VzLgoKNi4g IFNvdXJjZSBJUCBBZGRyZXNzCgogICBUaGUgc291cmNlIElQIGFkZHJlc3Mgb2YgdGhlIFVEUCBk YXRhZ3JhbXMgU0hPVUxEIE5PVCBiZSBpbnRlcnByZXRlZAogICBhcyB0aGUgaWRlbnRpZmllciBm b3IgdGhlIGhvc3QgdGhhdCBvcmlnaW5hdGVkIHRoZSBzeXNsb2cgbWVzc2FnZS4KICAgVGhlIGVu dGl0eSBzZW5kaW5nIHRoZSBzeXNsb2cgbWVzc2FnZSBtYXkgYmUgbWVyZWx5IGEgcmVsYXkuICBU aGUKICAgc3lzbG9nIG1lc3NhZ2UgaXRzZWxmIGNvbnRhaW5zIHRoZSBpZGVudGlmaWVyIG9mIHRo ZSBvcmlnaW5hdG9yIG9mCiAgIHRoZSBtZXNzYWdlLgoKNy4gIFVEUC9JUCBTdHJ1Y3R1cmUKCiAg IEVhY2ggVURQL0lQIGRhdGFncmFtIHNlbnQgYnkgdGhlIHRyYW5zcG9ydCBsYXllciBNVVNUIGNv bXBsZXRlbHkKICAgYWRoZXJlIHRvIHRoZSBzdHJ1Y3R1cmUgc3BlY2lmaWVkIGluIHRoZSBVRFAg UkZDIDc2OCBbMV0gYW5kIGVpdGhlcgogICBJUHY0IFJGQyA3OTEgWzNdIG9yIElQdjYgUkZDIDI2 NDAgWzRdIGRlcGVuZGluZyBvbiB3aGljaCBwcm90b2NvbCBpcwogICB1c2VkLgoKOC4gIFVEUCBD aGVja3N1bXMKCiAgIFVzZSBvZiBVRFAgY2hlY2tzdW1zIHdhcyBkZWZpbmVkIGFzIE9QVElPTkFM IGluIFJGQyA3NjggWzFdLiAgSVB2NgogICBoYXMgc3Vic2VxdWVudGx5IG1hZGUgVURQIGNoZWNr c3VtcyBSRVFVSVJFRCBpbiBSRkMgMjQ2MCBbNF0uCgoKCk9rbWlhbnNraSAgICAgICAgICAgICAg ICBFeHBpcmVzIEphbnVhcnkgNywgMjAwNiAgICAgICAgICAgICAgICBbUGFnZSA0XQoMCkludGVy bmV0LURyYWZ0ICAgICAgICAgICAgc3lzbG9nIHVkcCB0cmFuc3BvcnQgICAgICAgICAgICAgICAg IEp1bHkgMjAwNQoKCiAgIFN5c2xvZyBzZW5kZXJzIE1VU1QgdXNlIHZhbGlkIFVEUCBjaGVja3N1 bXMgd2hlbiBzZW5kaW5nIG1lc3NhZ2VzCiAgIG92ZXIgSVB2Ni4gIFN5c2xvZyBzZW5kZXJzIFNI T1VMRCB1c2UgVURQIGNoZWNrc3VtcyB3aGVuIHNlbmRpbmcKICAgbWVzc2FnZXMgb3ZlciBJUHY0 LgoKICAgU3lzbG9nIHJlY2VpdmVycyBNVVNUIGNoZWNrIHRoZSBjaGVja3N1bXMgd2hlbmV2ZXIg dGhleSBhcmUgcHJlc2VudAogICBhbmQgZGlzY2FyZCBtZXNzYWdlcyB3aXRoIGluY29ycmVjdCBj aGVja3N1bXMuICBOb3RlIHRoYXQgdGhpcyBpcwogICB0eXBpY2FsbHkgYWNjb21wbGlzaGVkIGJ5 IHRoZSBVRFAgbGF5ZXIgaW1wbGVtZW50YXRpb24sIGFuZCBzb21lIFVEUAogICBpbXBsZW1lbnRh dGlvbnMgYWxsb3cgZm9yIGNoZWNrc3VtIHZhbGlkYXRpb24gdG8gYmUgZW5hYmxlZCBvcgogICBk aXNhYmxlZC4KCjkuICBSZWxpYWJpbGl0eSBDb25zaWRlcmF0aW9ucwoKICAgVGhlIFVEUCBpcyBh biB1bnJlbGlhYmxlIGxvdy1vdmVyaGVhZCBwcm90b2NvbC4gIFRoaXMgc2VjdGlvbgogICBkaXNj dXNzZXMgcmVsaWFiaWxpdHkgaXNzdWVzIGluaGVyZW50IGluIFVEUCB0aGF0IGltcGxlbWVudGVy cyBhbmQKICAgdXNlcnMgTVVTVCBiZSBhd2FyZSBvZi4KCjkuMSAgTG9zdCBEYXRhZ3JhbXMKCiAg IFRoaXMgdHJhbnNwb3J0IHByb3RvY29sIGRvZXMgbm90IHByb3ZpZGUgYW55IG1lY2hhbmlzbSB0 byBkZXRlY3QgYW5kCiAgIGNvcnJlY3QgbG9zcyBvZiBkYXRhZ3JhbXMuICBEYXRhZ3JhbXMgbWF5 IGJlIGxvc3QgaW4gdHJhbnNpdCBkdWUgdG8KICAgY29uZ2VzdGlvbiwgY29ycnVwdGlvbiwgb3Ig YW55IG90aGVyIGludGVybWl0dGVudCBuZXR3b3JrIHByb2JsZW0uCiAgIElQIGZyYWdtZW50YXRp b24gZXhhY2VyYmF0ZXMgdGhpcyBwcm9ibGVtIGJlY2F1c2UgbG9zcyBvZiBhIHNpbmdsZQogICBm cmFnbWVudCB3aWxsIHJlc3VsdCBpbiB0aGUgZW50aXJlIG1lc3NhZ2UgYmVpbmcgZGlzY2FyZGVk LgoKICAgSW4gc29tZSBjaXJjdW1zdGFuY2VzIHRoZSBzZW5kZXIgbWF5IHJlY2VpdmUgYW4gSUNN UCBlcnJvciBtZXNzYWdlIG9yCiAgIG90aGVyIGluZGljYXRpb24gb2YgYSB0cmFuc21pc3Npb24g cHJvYmxlbS4gIElmIHRoZSBzZW5kZXIgcmVjZWl2ZXMgYQogICByZWFzb25hYmxlIGluZGljYXRp b24gdGhhdCBhIGRhdGFncmFtIG1heSBoYXZlIGJlZW4gbG9zdCwgaXQgTUFZCiAgIHJldHJhbnNt aXQgdGhlIGRhdGFncmFtLgoKOS4yICBNZXNzYWdlIENvcnJ1cHRpb24KCiAgIFRoZSBVRFAvSVAg ZGF0YWdyYW1zIG1heSBnZXQgY29ycnVwdGVkIGluIHRyYW5zaXQgZHVlIHRvIHNvZnR3YXJlLAog ICBoYXJkd2FyZSwgb3IgbmV0d29yayBlcnJvcnMuICBUaGlzIHByb3RvY29sIHNwZWNpZmllcyB1 c2Ugb2YgVURQCiAgIGNoZWNrc3VtcyB0byBlbmFibGUgY29ycnVwdGlvbiBkZXRlY3Rpb24gaW4g YWRkaXRpb24gdG8gY2hlY2tzdW1zCiAgIHVzZWQgaW4gSVAgYW5kIExheWVyIDIgcHJvdG9jb2xz LiAgSG93ZXZlciwgY2hlY2tzdW1zIGRvIG5vdAogICBndWFyYW50ZWUgY29ycnVwdGlvbiBkZXRl Y3Rpb24sIGFuZCB0aGlzIHByb3RvY29sIGRvZXMgbm90IHByb3ZpZGUKICAgZm9yIG1lc3NhZ2Ug cmV0cmFuc21pc3Npb24gd2hlbiBhIGNvcnJ1cHQgbWVzc2FnZSBpcyBkZXRlY3RlZC4KCiAgIEEg c3BlY2lhbCBjYXNlIG9mIGNvcnJ1cHRpb24gaXMgY29ycnVwdGlvbiBpbnRyb2R1Y2VkIGJ5IHRo ZSBVRFAKICAgaW1wbGVtZW50YXRpb24gaXRzZWxmLiAgRm9yIGV4YW1wbGUsIHNldmVyYWwgZWFy bGllciBVRFAKICAgaW1wbGVtZW50YXRpb25zIGRlZmF1bHRlZCB0byBhIGJ1ZmZlciBzaXplIG9m IGxlc3MgdGhhbiA2NTUzNiBieXRlcwogICBhbmQgdHJ1bmNhdGVkIGxhcmdlciBwYXlsb2FkcyB1 cG9uIHJlY2VpcHQgWzldLiAgQnkgZm9sbG93aW5nIHRoZQogICBtZXNzYWdlIHNpemUgcmVjb21t ZW5kYXRpb25zIG9mIHRoaXMgcHJvdG9jb2wsIGFwcGxpY2F0aW9uIGRldmVsb3BlcnMKICAgY2Fu IHNpZ25pZmljYW50bHkgcmVkdWNlIHRoZSByaXNrIG9mIHRoaXMgdHlwZSBvZiBlcnJvci4KCjku MyAgQ29uZ2VzdGlvbiBDb250cm9sCgogICBUaGUgVURQIGRvZXMgbm90IHByb3ZpZGUgZm9yIGNv bmdlc3Rpb24gY29udHJvbC4gIEFueSBuZXR3b3JrIGhvc3Qgb3IKCgoKT2ttaWFuc2tpICAgICAg ICAgICAgICAgIEV4cGlyZXMgSmFudWFyeSA3LCAyMDA2ICAgICAgICAgICAgICAgIFtQYWdlIDVd CgwKSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICBzeXNsb2cgdWRwIHRyYW5zcG9ydCAgICAgICAg ICAgICAgICAgSnVseSAyMDA1CgoKICAgcm91dGVyIGNhbiBkaXNjYXJkIFVEUCBwYWNrZXRzIHdo ZW4gaXQgaXMgb3ZlcmxvYWRlZCwgYW5kIGl0IG1heSBvcgogICBtYXkgbm90IHByb3ZpZGUgYW4g SUNNUCBlcnJvciB0byBpbmRpY2F0ZSB0aGlzLiAgT25lIG9yIG11bHRpcGxlCiAgIHN5c2xvZyBz ZW5kZXJzIGNhbiBtYWxpY2lvdXNseSBvciBpbmFkdmVydGVudGx5IG92ZXJsb2FkIHRoZSByZWNl aXZlcgogICBvciB0aGUgbmV0d29yayBpbmZyYXN0cnVjdHVyZSBhbmQgY2F1c2UgbG9zcyBvZiBz eXNsb2cgbWVzc2FnZXMuCgo5LjQgIFNlcXVlbmNlZCBEZWxpdmVyeQoKICAgVGhlIElQIHRyYW5z cG9ydCB1c2VkIGJ5IHRoZSBVRFAgZG9lcyBub3QgZ3VhcmFudGVlIHRoYXQgdGhlIHNlcXVlbmNl CiAgIG9mIGRhdGFncmFtIGRlbGl2ZXJ5IHdpbGwgbWF0Y2ggdGhlIG9yZGVyIGluIHdoaWNoIHRo ZSBkYXRhZ3JhbXMgd2VyZQogICBzZW50LiAgVGhlIHRpbWUgc3RhbXAgY29udGFpbmVkIHdpdGhp biBlYWNoIHN5c2xvZyBtZXNzYWdlIG1heSBzZXJ2ZQogICBhcyBhIHJvdWdoIGd1aWRlIGluIGVz dGFibGlzaGluZyBzZXF1ZW5jZSBvcmRlciwgYnV0IGl0IHdpbGwgbm90IGhlbHAKICAgaW4gY2Fz ZXMgd2hlbiBtdWx0aXBsZSBtZXNzYWdlcyB3ZXJlIGdlbmVyYXRlZCBkdXJpbmcgdGhlIHNhbWUg dGltZQogICBzbG90LCB0aGUgc2VuZGVyIGNhbm5vdCBnZW5lcmF0ZSBhIHRpbWUgc3RhbXAsIG9y IG1lc3NhZ2VzIG9yaWdpbmF0ZWQKICAgZnJvbSBkaWZmZXJlbnQgaG9zdHMgd2hvc2UgY2xvY2tz IGFyZSBub3Qgc3luY2hyb25pemVkLiAgVGhlIG9yZGVyIG9mCiAgIHN5c2xvZyBtZXNzYWdlIGFy cml2YWwgdmlhIHRoaXMgdHJhbnNwb3J0IFNIT1VMRCBOT1QgYmUgdXNlZCBhcyBhbgogICBhdXRo b3JpdGF0aXZlIGd1aWRlIGluIGVzdGFibGlzaGluZyBhbiBhYnNvbHV0ZSBvciByZWxhdGl2ZSBz ZXF1ZW5jZQogICBvZiBldmVudHMgb24gdGhlIHN5c2xvZyBzZW5kZXIgaG9zdHMuCgoxMC4gIFNl Y3VyaXR5IENvbnNpZGVyYXRpb25zCgogICBTZXZlcmFsIHN5c2xvZyBzZWN1cml0eSBjb25zaWRl cmF0aW9ucyBhcmUgZGlzY3Vzc2VkIGluIFJGQy1wcm90b2NvbAogICBbMl0uICBUaGlzIHNlY3Rp b24gZm9jdXNlcyBvbiBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBzcGVjaWZpYyB0byB0aGUKICAg c3lzbG9nIHRyYW5zcG9ydCBvdmVyIFVEUC4KCjEwLjEgIFNlbmRlciBBdXRoZW50aWNhdGlvbgoK ICAgVGhpcyB0cmFuc3BvcnQgcHJvdG9jb2wgZG9lcyBub3QgcHJvdmlkZSBmb3Igc3Ryb25nIHNl bmRlcgogICBhdXRoZW50aWNhdGlvbi4gIFRoZSByZWNlaXZlciBvZiB0aGUgc3lzbG9nIG1lc3Nh Z2Ugd2lsbCBub3QgYmUgYWJsZQogICB0byBhc2NlcnRhaW4gdGhhdCB0aGUgbWVzc2FnZSB3YXMg aW5kZWVkIHNlbnQgZnJvbSB0aGUgcmVwb3J0ZWQKICAgc2VuZGVyLCBvciB3aGV0aGVyIHRoZSBw YWNrZXQgd2FzIHNlbnQgZnJvbSBhbm90aGVyIGRldmljZS4gIFRoaXMgbWF5CiAgIGFsc28gbGVh ZCB0byBhIGNhc2Ugb2YgbWlzdGFrZW4gaWRlbnRpdHkgaWYgYSBtaXNjb25maWd1cmVkIG1hY2hp bmUKICAgc2VuZHMgc3lzbG9nIG1lc3NhZ2VzIHRvIGEgcmVjZWl2ZXIgcmVwcmVzZW50aW5nIGl0 c2VsZiBhcyBhbm90aGVyCiAgIG1hY2hpbmUuCgoxMC4yICBNZXNzYWdlIEZvcmdlcnkKCiAgIFRo aXMgdHJhbnNwb3J0IHByb3RvY29sIGRvZXMgbm90IHByb3ZpZGUgcHJvdGVjdGlvbiBhZ2FpbnN0 IHN5c2xvZwogICBtZXNzYWdlIGZvcmdlcnkuICBBbiBhdHRhY2tlciBtYXkgdHJhbnNtaXQgc3lz bG9nIG1lc3NhZ2VzIChlaXRoZXIKICAgZnJvbSB0aGUgbWFjaGluZSBmcm9tIHdoaWNoIHRoZSBt ZXNzYWdlcyBhcmUgcHVycG9ydGVkbHkgc2VudCBvciBmcm9tCiAgIGFueSBvdGhlciBtYWNoaW5l KSB0byBhIHJlY2VpdmVyLgoKICAgSW4gb25lIGNhc2UsIGFuIGF0dGFja2VyIG1heSBoaWRlIHRo ZSB0cnVlIG5hdHVyZSBvZiBhbiBhdHRhY2sgYW1pZHN0CiAgIG1hbnkgb3RoZXIgbWVzc2FnZXMu ICBBcyBhbiBleGFtcGxlLCBhbiBhdHRhY2tlciBtYXkgc3RhcnQgZ2VuZXJhdGluZwogICBmb3Jn ZWQgbWVzc2FnZXMgaW5kaWNhdGluZyBhIHByb2JsZW0gb24gc29tZSBtYWNoaW5lLiAgVGhpcyBt YXkgZ2V0CiAgIHRoZSBhdHRlbnRpb24gb2YgdGhlIHN5c3RlbSBhZG1pbmlzdHJhdG9ycywgd2hv IHdpbGwgc3BlbmQgdGhlaXIgdGltZQogICBpbnZlc3RpZ2F0aW5nIHRoZSBhbGxlZ2VkIHByb2Js ZW0uICBEdXJpbmcgdGhpcyB0aW1lLCB0aGUgYXR0YWNrZXIKICAgbWF5IGJlIGFibGUgdG8gY29t cHJvbWlzZSBhIGRpZmZlcmVudCBtYWNoaW5lIG9yIGEgZGlmZmVyZW50IHByb2Nlc3MKICAgb24g dGhlIHNhbWUgbWFjaGluZS4KCgoKT2ttaWFuc2tpICAgICAgICAgICAgICAgIEV4cGlyZXMgSmFu dWFyeSA3LCAyMDA2ICAgICAgICAgICAgICAgIFtQYWdlIDZdCgwKSW50ZXJuZXQtRHJhZnQgICAg ICAgICAgICBzeXNsb2cgdWRwIHRyYW5zcG9ydCAgICAgICAgICAgICAgICAgSnVseSAyMDA1CgoK ICAgQWRkaXRpb25hbGx5LCBhbiBhdHRhY2tlciBtYXkgZ2VuZXJhdGUgZmFsc2Ugc3lzbG9nIG1l c3NhZ2VzIHRvIGdpdmUKICAgdW50cnVlIGluZGljYXRpb25zIG9mIHRoZSBzdGF0dXMgb2Ygc3lz dGVtcy4gIEFzIGFuIGV4YW1wbGUsIGFuCiAgIGF0dGFja2VyIG1heSBzdG9wIGEgY3JpdGljYWwg cHJvY2VzcyBvbiBhIG1hY2hpbmUsIHdoaWNoIG1heSBnZW5lcmF0ZQogICBhIG5vdGlmaWNhdGlv biBvZiBleGl0LiAgVGhlIGF0dGFja2VyIG1heSBzdWJzZXF1ZW50bHkgZ2VuZXJhdGUgYQogICBm b3JnZWQgbm90aWZpY2F0aW9uIHRoYXQgdGhlIHByb2Nlc3MgaGFkIGJlZW4gcmVzdGFydGVkLiAg VGhlIHN5c3RlbQogICBhZG1pbmlzdHJhdG9ycyBtYXkgYWNjZXB0IHRoYXQgbWlzaW5mb3JtYXRp b24gYW5kIG5vdCB2ZXJpZnkgdGhhdCB0aGUKICAgcHJvY2VzcyBoYWQgaW5kZWVkIG5vdCBiZWVu IHJlc3RhcnRlZC4KCjEwLjMgIE1lc3NhZ2UgT2JzZXJ2YXRpb24KCiAgIFRoaXMgdHJhbnNwb3J0 IHByb3RvY29sIGRvZXMgbm90IHByb3ZpZGUgY29uZmlkZW50aWFsaXR5IG9mIHRoZQogICBtZXNz YWdlcyBpbiB0cmFuc2l0LiAgSWYgc3lzbG9nIG1lc3NhZ2VzIGFyZSBpbiBjbGVhciB0ZXh0LCB0 aGlzIGlzCiAgIGhvdyB0aGV5IHdpbGwgYmUgdHJhbnNmZXJyZWQuICBJbiBtb3N0IGNhc2VzIHBh c3NpbmcgY2xlYXItdGV4dAogICBodW1hbi1yZWFkYWJsZSBtZXNzYWdlcyBpcyBhIGJlbmVmaXQg dG8gdGhlIGFkbWluaXN0cmF0b3JzLgogICBVbmZvcnR1bmF0ZWx5LCBhbiBhdHRhY2tlciBtYXkg YWxzbyBiZSBhYmxlIHRvIG9ic2VydmUgdGhlIGh1bWFuLQogICByZWFkYWJsZSBjb250ZW50cyBv ZiBzeXNsb2cgbWVzc2FnZXMuICBUaGUgYXR0YWNrZXIgbWF5IHRoZW4gdXNlIHRoZQogICBrbm93 bGVkZ2UgZ2FpbmVkIGZyb20gdGhlc2UgbWVzc2FnZXMgdG8gY29tcHJvbWlzZSBhIG1hY2hpbmUu ICBJdCBpcwogICBSRUNPTU1FTkRFRCB0aGF0IG5vIHNlbnNpdGl2ZSBpbmZvcm1hdGlvbiBiZSB0 cmFuc21pdHRlZCB2aWEgdGhpcwogICB0cmFuc3BvcnQgcHJvdG9jb2wgb3IgdGhhdCB0cmFuc21p c3Npb24gb2Ygc3VjaCBpbmZvcm1hdGlvbiBiZQogICByZXN0cmljdGVkIHRvIHByb3Blcmx5IHNl Y3VyZWQgbmV0d29ya3MuCgoxMC40ICBSZXBsYXlpbmcKCiAgIE1lc3NhZ2UgZm9yZ2VyeSBhbmQg b2JzZXJ2YXRpb24gY2FuIGJlIGNvbWJpbmVkIGludG8gYSByZXBsYXkgYXR0YWNrLgogICBBbiBh dHRhY2tlciBtYXkgcmVjb3JkIGEgc2V0IG9mIG1lc3NhZ2VzIHRoYXQgaW5kaWNhdGUgbm9ybWFs CiAgIGFjdGl2aXR5IG9mIGEgbWFjaGluZS4gIEF0IGEgbGF0ZXIgdGltZSwgYW4gYXR0YWNrZXIg bWF5IHJlbW92ZSB0aGF0CiAgIG1hY2hpbmUgZnJvbSB0aGUgbmV0d29yayBhbmQgcmVwbGF5IHRo ZSBzeXNsb2cgbWVzc2FnZXMgd2l0aCBuZXcgdGltZQogICBzdGFtcHMuICBUaGUgYWRtaW5pc3Ry YXRvcnMgbWF5IGZpbmQgbm90aGluZyB1bnVzdWFsIGluIHRoZSByZWNlaXZlZAogICBtZXNzYWdl cywgYW5kIHRoZWlyIHJlY2VpcHQgd291bGQgZmFsc2VseSBpbmRpY2F0ZSBub3JtYWwgYWN0aXZp dHkgb2YKICAgdGhlIG1hY2hpbmUuCgoxMC41ICBVbnJlbGlhYmxlIERlbGl2ZXJ5CgogICBBcyB3 YXMgcHJldmlvdXNseSBkaXNjdXNzZWQgaW4gdGhlIFJlbGlhYmlsaXR5IENvbnNpZGVyYXRpb25z CiAgIHNlY3Rpb24sIHRoZSBVRFAgdHJhbnNwb3J0IGlzIG5vdCByZWxpYWJsZSwgYW5kIHBhY2tl dHMgY29udGFpbmluZwogICBzeXNsb2cgbWVzc2FnZSBkYXRhZ3JhbXMgY2FuIGJlIGxvc3QgaW4g dHJhbnNpdCB3aXRob3V0IGFueSBub3RpY2UuCiAgIFRoZXJlIGNhbiBiZSBzZWN1cml0eSBjb25z ZXF1ZW5jZXMgdG8gdGhlIGxvc3Mgb2Ygb25lIG9yIG1vcmUgc3lzbG9nCiAgIG1lc3NhZ2VzLiAg QWRtaW5pc3RyYXRvcnMgbWF5IG5vdCBiZWNvbWUgYXdhcmUgb2YgYSBkZXZlbG9waW5nIGFuZAog ICBwb3RlbnRpYWxseSBzZXJpb3VzIHByb2JsZW0uICBNZXNzYWdlcyBtYXkgYWxzbyBiZSBpbnRl cmNlcHRlZCBhbmQKICAgZGlzY2FyZGVkIGJ5IGFuIGF0dGFja2VyIGFzIGEgd2F5IHRvIGhpZGUg dW5hdXRob3JpemVkIGFjdGl2aXRpZXMuCgoxMC42ICBNZXNzYWdlIFByaW9yaXRpemF0aW9uIGFu ZCBEaWZmZXJlbnRpYXRpb24KCiAgIFRoaXMgdHJhbnNwb3J0IHByb3RvY29sIGRvZXMgbm90IG1h bmRhdGUgcHJpb3JpdGl6YXRpb24gb2Ygc3lzbG9nCiAgIG1lc3NhZ2VzIG9uIHRoZSB3aXJlIG9y IHdoZW4gcHJvY2Vzc2VkIG9uIHRoZSByZWNlaXZpbmcgaG9zdCBiYXNlZCBvbgogICB0aGVpciBz ZXZlcml0eS4gIFRoZSBzZWN1cml0eSBpbXBsaWNhdGlvbiBvZiBzdWNoIGJlaGF2aW9yIGlzIHRo YXQKICAgdGhlIHN5c2xvZyByZWNlaXZlciBvciBuZXR3b3JrIGRldmljZXMgbWF5IGdldCBvdmVy d2hlbG1lZCB3aXRoIGxvdy0KICAgc2V2ZXJpdHkgbWVzc2FnZXMgYW5kIGJlIGZvcmNlZCB0byBk aXNjYXJkIHBvdGVudGlhbGx5IGhpZ2gtc2V2ZXJpdHkKCgoKT2ttaWFuc2tpICAgICAgICAgICAg ICAgIEV4cGlyZXMgSmFudWFyeSA3LCAyMDA2ICAgICAgICAgICAgICAgIFtQYWdlIDddCgwKSW50 ZXJuZXQtRHJhZnQgICAgICAgICAgICBzeXNsb2cgdWRwIHRyYW5zcG9ydCAgICAgICAgICAgICAg ICAgSnVseSAyMDA1CgoKICAgbWVzc2FnZXMuICBIaWdoLXNldmVyaXR5IG1lc3NhZ2VzIG1heSBj b250YWluIGFuIGluZGljYXRpb24gb2YKICAgc2VyaW91cyBzZWN1cml0eSBwcm9ibGVtcywgYnV0 IHRoZXkgd2lsbCBub3QgZ2V0IGEgaGlnaGVyIHByaW9yaXR5LgoKMTAuNyAgRGVuaWFsIG9mIFNl cnZpY2UKCiAgIEFuIGF0dGFja2VyIG1heSBvdmVyd2hlbG0gYSByZWNlaXZlciBieSBzZW5kaW5n IG1vcmUgbWVzc2FnZXMgdG8gaXQKICAgdGhhbiBjYW4gYmUgaGFuZGxlZCBieSB0aGUgaW5mcmFz dHJ1Y3R1cmUgb3IgdGhlIGRldmljZSBpdHNlbGYuCiAgIEltcGxlbWVudGVycyBTSE9VTEQgYXR0 ZW1wdCB0byBwcm92aWRlIGZlYXR1cmVzIHRoYXQgbWluaW1pemUgdGhpcwogICB0aHJlYXQgc3Vj aCBhcyBvcHRpb25hbGx5IHJlc3RyaWN0aW5nIHJlY2VwdGlvbiBvZiBtZXNzYWdlcyB0byBhIHNl dAogICBvZiBrbm93IHNvdXJjZSBJUCBhZGRyZXNzZXMuCgoxMS4gIElBTkEgQ29uc2lkZXJhdGlv bnMKCiAgIElBTkEgbXVzdCByZXNlcnZlIFVEUCBwb3J0IDUxNCBmb3IgdGhpcyB0cmFuc3BvcnQu CgoxMi4gIE5vdGljZSB0byBSRkMgRWRpdG9yCgogICBUaGlzIGlzIGEgbm90aWNlIHRvIHRoZSBS RkMgZWRpdG9yLiAgVGhpcyBJRCBpcyBzdWJtaXR0ZWQgYWxvbmcgd2l0aAogICBJRCBkcmFmdC1p ZXRmLXN5c2xvZy1wcm90b2NvbCBhbmQgdGhleSBjcm9zcy1yZWZlcmVuY2UgZWFjaCBvdGhlci4K ICAgV2hlbiBSRkMgbnVtYmVycyBhcmUgZGV0ZXJtaW5lZCBmb3IgZWFjaCBvZiB0aGVzZSBJRHMs IHBsZWFzZSByZXBsYWNlCiAgIGFsbCByZWZlcmVuY2VzIHRvICJSRkMtcHJvdG9jb2wiIHdpdGgg dGhlIFJGQyBudW1iZXIgb2YKICAgZHJhZnQtaWV0Zi1zeXNsb2ctcHJvdG9jb2wgSUQuICBQbGVh c2UgcmVtb3ZlIHRoaXMgc2VjdGlvbiBhZnRlcgogICBlZGl0aW5nLgoKMTMuICBXb3JraW5nIEdy b3VwCgogICBUaGUgd29ya2luZyBncm91cCBjYW4gYmUgY29udGFjdGVkIHZpYSB0aGUgbWFpbGlu ZyBsaXN0OgoKICAgICAgIHN5c2xvZy1zZWNAZW1wbG95ZWVzLm9yZwoKICAgVGhlIGN1cnJlbnQg Q2hhaXIgb2YgdGhlIFdvcmtpbmcgR3JvdXAgbWF5IGJlIGNvbnRhY3RlZCBhdDoKCiAgICAgICBD aHJpcyBMb252aWNrCiAgICAgICBDaXNjbyBTeXN0ZW1zCiAgICAgICBFbWFpbDogY2xvbnZpY2tA Y2lzY28uY29tCgoKMTQuICBBY2tub3dsZWRnZW1lbnRzCgogICBUaGUgYXV0aG9yIGdyYXRlZnVs bHkgYWNrbm93bGVkZ2VzIHRoZSBjb250cmlidXRpb25zIG9mOiBDaHJpcwogICBMb252aWNrLCBS YWluZXIgR2VyaGFyZHMsIERhdmlkIEhhcnJpbmd0b24sIEFuZHJldyBSb3NzLCBBbGJlcnQKICAg TWlldHVzLCBCZXJuaWUgVm9seiwgTWlja2FlbCBHcmFoYW0sIEdyZWcgTW9ycmlzLCBBbGV4YW5k cmEgRmVkb3JvdmEsCiAgIERldmluIEtvd2F0Y2gsIFJpY2hhcmQgR3JhdmVtYW4sIGFuZCBhbGwg b3RoZXJzIHdobyBoYXZlIGNvbW1lbnRlZCBvbgogICB0aGUgdmFyaW91cyB2ZXJzaW9ucyBvZiB0 aGlzIHByb3Bvc2FsLgoKMTUuICBSZWZlcmVuY2VzCgoKCgoKT2ttaWFuc2tpICAgICAgICAgICAg ICAgIEV4cGlyZXMgSmFudWFyeSA3LCAyMDA2ICAgICAgICAgICAgICAgIFtQYWdlIDhdCgwKSW50 ZXJuZXQtRHJhZnQgICAgICAgICAgICBzeXNsb2cgdWRwIHRyYW5zcG9ydCAgICAgICAgICAgICAg ICAgSnVseSAyMDA1CgoKMTUuMSAgTm9ybWF0aXZlIFJlZmVyZW5jZXMKCiAgIFsxXSAgUG9zdGVs LCBKLiwgIlVzZXIgRGF0YWdyYW0gUHJvdG9jb2wiLCBTVEQgNiwgUkZDIDc2OCwKICAgICAgICBB dWd1c3QgMTk4MC4KCiAgIFsyXSAgR2VyaGFyZHMsIFIuLCAiVGhlIHN5c2xvZyBQcm90b2NvbCIs IFJGQyBSRkMtcHJvdG9jb2wuCgogICBbM10gIFBvc3RlbCwgSi4sICJJbnRlcm5ldCBQcm90b2Nv bCIsIFNURCA1LCBSRkMgNzkxLCBTZXB0ZW1iZXIgMTk4MS4KCiAgIFs0XSAgRGVlcmluZywgUy4g YW5kIFIuIEhpbmRlbiwgIkludGVybmV0IFByb3RvY29sLCBWZXJzaW9uIDYgKElQdjYpCiAgICAg ICAgU3BlY2lmaWNhdGlvbiIsIFJGQyAyNDYwLCBEZWNlbWJlciAxOTk4LgoKICAgWzVdICBCcmFk bmVyLCBTLiwgIktleSB3b3JkcyBmb3IgdXNlIGluIFJGQ3MgdG8gSW5kaWNhdGUgUmVxdWlyZW1l bnQKICAgICAgICBMZXZlbHMiLCBCQ1AgMTQsIFJGQyAyMTE5LCBNYXJjaCAxOTk3LgoKICAgWzZd ICBCcmFkZW4sIFIuLCAiUmVxdWlyZW1lbnRzIGZvciBJbnRlcm5ldCBIb3N0cyAtIENvbW11bmlj YXRpb24KICAgICAgICBMYXllcnMiLCBTVEQgMywgUkZDIDExMjIsIE9jdG9iZXIgMTk4OS4KCjE1 LjIgIEluZm9ybWF0aXZlIFJlZmVyZW5jZXMKCiAgIFs3XSAgTG9udmljaywgQy4sICJUaGUgQlNE IFN5c2xvZyBQcm90b2NvbCIsIFJGQyAzMTY0LCBBdWd1c3QgMjAwMS4KCiAgIFs4XSAgTW9ndWws IEouIGFuZCBTLiBEZWVyaW5nLCAiUGF0aCBNVFUgZGlzY292ZXJ5IiwgUkZDIDExOTEsCiAgICAg ICAgTm92ZW1iZXIgMTk5MC4KCiAgIFs5XSAgU3RldmVucywgVy4sICJUQ1AvSVAgSWxsdXN0cmF0 ZWQgVm9sdW1lIDEuIFRoZSBQcm90b2NvbHMuIiwKICAgICAgICBKYW51YXJ5IDE5OTQuCgoKQXV0 aG9yJ3MgQWRkcmVzcwoKICAgQW50b24gT2ttaWFuc2tpCiAgIENpc2NvIFN5c3RlbXMsIEluYy4K ICAgMTQxNCBNYXNzYWNodXNldHRzIEF2ZQogICBCb3hib3JvdWdoLCBNQSAgMDE3MTktMjIwNQog ICBVU0EKCiAgIFBob25lOiArMS05NzgtOTM2LTE2MTIKICAgRW1haWw6IGFva21pYW5zQGNpc2Nv LmNvbQoKCgoKCgoKCgoKCgpPa21pYW5za2kgICAgICAgICAgICAgICAgRXhwaXJlcyBKYW51YXJ5 IDcsIDIwMDYgICAgICAgICAgICAgICAgW1BhZ2UgOV0KDApJbnRlcm5ldC1EcmFmdCAgICAgICAg ICAgIHN5c2xvZyB1ZHAgdHJhbnNwb3J0ICAgICAgICAgICAgICAgICBKdWx5IDIwMDUKCgpJbnRl bGxlY3R1YWwgUHJvcGVydHkgU3RhdGVtZW50CgogICBUaGUgSUVURiB0YWtlcyBubyBwb3NpdGlv biByZWdhcmRpbmcgdGhlIHZhbGlkaXR5IG9yIHNjb3BlIG9mIGFueQogICBJbnRlbGxlY3R1YWwg UHJvcGVydHkgUmlnaHRzIG9yIG90aGVyIHJpZ2h0cyB0aGF0IG1pZ2h0IGJlIGNsYWltZWQgdG8K ICAgcGVydGFpbiB0byB0aGUgaW1wbGVtZW50YXRpb24gb3IgdXNlIG9mIHRoZSB0ZWNobm9sb2d5 IGRlc2NyaWJlZCBpbgogICB0aGlzIGRvY3VtZW50IG9yIHRoZSBleHRlbnQgdG8gd2hpY2ggYW55 IGxpY2Vuc2UgdW5kZXIgc3VjaCByaWdodHMKICAgbWlnaHQgb3IgbWlnaHQgbm90IGJlIGF2YWls YWJsZTsgbm9yIGRvZXMgaXQgcmVwcmVzZW50IHRoYXQgaXQgaGFzCiAgIG1hZGUgYW55IGluZGVw ZW5kZW50IGVmZm9ydCB0byBpZGVudGlmeSBhbnkgc3VjaCByaWdodHMuICBJbmZvcm1hdGlvbgog ICBvbiB0aGUgcHJvY2VkdXJlcyB3aXRoIHJlc3BlY3QgdG8gcmlnaHRzIGluIFJGQyBkb2N1bWVu dHMgY2FuIGJlCiAgIGZvdW5kIGluIEJDUCA3OCBhbmQgQkNQIDc5LgoKICAgQ29waWVzIG9mIElQ UiBkaXNjbG9zdXJlcyBtYWRlIHRvIHRoZSBJRVRGIFNlY3JldGFyaWF0IGFuZCBhbnkKICAgYXNz dXJhbmNlcyBvZiBsaWNlbnNlcyB0byBiZSBtYWRlIGF2YWlsYWJsZSwgb3IgdGhlIHJlc3VsdCBv ZiBhbgogICBhdHRlbXB0IG1hZGUgdG8gb2J0YWluIGEgZ2VuZXJhbCBsaWNlbnNlIG9yIHBlcm1p c3Npb24gZm9yIHRoZSB1c2Ugb2YKICAgc3VjaCBwcm9wcmlldGFyeSByaWdodHMgYnkgaW1wbGVt ZW50ZXJzIG9yIHVzZXJzIG9mIHRoaXMKICAgc3BlY2lmaWNhdGlvbiBjYW4gYmUgb2J0YWluZWQg ZnJvbSB0aGUgSUVURiBvbi1saW5lIElQUiByZXBvc2l0b3J5IGF0CiAgIGh0dHA6Ly93d3cuaWV0 Zi5vcmcvaXByLgoKICAgVGhlIElFVEYgaW52aXRlcyBhbnkgaW50ZXJlc3RlZCBwYXJ0eSB0byBi cmluZyB0byBpdHMgYXR0ZW50aW9uIGFueQogICBjb3B5cmlnaHRzLCBwYXRlbnRzIG9yIHBhdGVu dCBhcHBsaWNhdGlvbnMsIG9yIG90aGVyIHByb3ByaWV0YXJ5CiAgIHJpZ2h0cyB0aGF0IG1heSBj b3ZlciB0ZWNobm9sb2d5IHRoYXQgbWF5IGJlIHJlcXVpcmVkIHRvIGltcGxlbWVudAogICB0aGlz IHN0YW5kYXJkLiAgUGxlYXNlIGFkZHJlc3MgdGhlIGluZm9ybWF0aW9uIHRvIHRoZSBJRVRGIGF0 CiAgIGlldGYtaXByQGlldGYub3JnLgoKCkRpc2NsYWltZXIgb2YgVmFsaWRpdHkKCiAgIFRoaXMg ZG9jdW1lbnQgYW5kIHRoZSBpbmZvcm1hdGlvbiBjb250YWluZWQgaGVyZWluIGFyZSBwcm92aWRl ZCBvbiBhbgogICAiQVMgSVMiIGJhc2lzIGFuZCBUSEUgQ09OVFJJQlVUT1IsIFRIRSBPUkdBTkla QVRJT04gSEUvU0hFIFJFUFJFU0VOVFMKICAgT1IgSVMgU1BPTlNPUkVEIEJZIChJRiBBTlkpLCBU SEUgSU5URVJORVQgU09DSUVUWSBBTkQgVEhFIElOVEVSTkVUCiAgIEVOR0lORUVSSU5HIFRBU0sg Rk9SQ0UgRElTQ0xBSU0gQUxMIFdBUlJBTlRJRVMsIEVYUFJFU1MgT1IgSU1QTElFRCwKICAgSU5D TFVESU5HIEJVVCBOT1QgTElNSVRFRCBUTyBBTlkgV0FSUkFOVFkgVEhBVCBUSEUgVVNFIE9GIFRI RQogICBJTkZPUk1BVElPTiBIRVJFSU4gV0lMTCBOT1QgSU5GUklOR0UgQU5ZIFJJR0hUUyBPUiBB TlkgSU1QTElFRAogICBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSBPUiBGSVRORVNTIEZP UiBBIFBBUlRJQ1VMQVIgUFVSUE9TRS4KCgpDb3B5cmlnaHQgU3RhdGVtZW50CgogICBDb3B5cmln aHQgKEMpIFRoZSBJbnRlcm5ldCBTb2NpZXR5ICgyMDA1KS4gIFRoaXMgZG9jdW1lbnQgaXMgc3Vi amVjdAogICB0byB0aGUgcmlnaHRzLCBsaWNlbnNlcyBhbmQgcmVzdHJpY3Rpb25zIGNvbnRhaW5l ZCBpbiBCQ1AgNzgsIGFuZAogICBleGNlcHQgYXMgc2V0IGZvcnRoIHRoZXJlaW4sIHRoZSBhdXRo b3JzIHJldGFpbiBhbGwgdGhlaXIgcmlnaHRzLgoKCkFja25vd2xlZGdtZW50CgogICBGdW5kaW5n IGZvciB0aGUgUkZDIEVkaXRvciBmdW5jdGlvbiBpcyBjdXJyZW50bHkgcHJvdmlkZWQgYnkgdGhl CiAgIEludGVybmV0IFNvY2lldHkuCgoKCgpPa21pYW5za2kgICAgICAgICAgICAgICAgRXhwaXJl cyBKYW51YXJ5IDcsIDIwMDYgICAgICAgICAgICAgICBbUGFnZSAxMF0KDAoK ------_=_NextPart_001_01C58238.07C41E80-- From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:51:58 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 4EA8F19046 for ; Mon, 22 Aug 2005 18:51:58 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:51:58 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 8 Jul 2005 09:13:53 -0700 Received: from syd-iport-1.cisco.com ([64.104.193.196]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 8 Jul 2005 09:13:53 -0700 Received: from syd-core-1.cisco.com (64.104.193.198) by syd-iport-1.cisco.com with ESMTP; 09 Jul 2005 02:42:56 +1000 Received: from sj-inbound-a.cisco.com (sj-inbound-a.cisco.com [128.107.234.204]) by syd-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j68GCe9A000904; Sat, 9 Jul 2005 02:13:07 +1000 (EST) Received: from willers.employees.org (192.83.249.36) by sj-inbound-a.cisco.com with ESMTP; 08 Jul 2005 09:13:31 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,274,1115017200"; d="scan'208"; a="139770064:sNHT17475236" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id F12AA5C80B; Fri, 8 Jul 2005 09:13:24 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-3.cisco.com (sj-iport-3-in.cisco.com [171.71.176.72]) by willers.employees.org (Postfix) with ESMTP id 9F97A5C79D for ; Fri, 8 Jul 2005 09:12:53 -0700 (PDT) Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-3.cisco.com with ESMTP; 08 Jul 2005 09:12:53 -0700 X-IronPort-AV: i="3.93,274,1115017200"; d="scan'208"; a="295151780:sNHT29619078" Received: from sjc-xdm1.cisco.com (sjc-xdm1.cisco.com [171.71.162.58]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j68GCloe021466; Fri, 8 Jul 2005 09:12:47 -0700 (PDT) Date: Fri, 8 Jul 2005 09:12:52 -0700 (PDT) From: Chris Lonvick To: "Anton Okmianski (aokmians)" Subject: RE: [Syslog-sec] Chair Review Comments ofdraft-ietf-syslog-transport-udp-04.txt In-Reply-To: <98AE08B66FAD1742BED6CB9522B731224771D2@xmb-rtp-20d.amer.cisco.com> Message-ID: References: <98AE08B66FAD1742BED6CB9522B731224771D2@xmb-rtp-20d.amer.cisco.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Mailman-Approved-At: Fri, 08 Jul 2005 09:13:23 -0700 Cc: syslog-sec@employees.org X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.234.204 X-OriginalArrivalTime: 08 Jul 2005 16:13:53.0751 (UTC) FILETIME=[09064E70:01C583D8] Status: RO X-Status: X-Keywords: X-UID: 8 Hi Anton, On Wed, 6 Jul 2005, Anton Okmianski (aokmians) wrote: > Chris: > > Thanks for feedback. Attached is the latest draft for final review by the group before I send it out officially. One follow up question below... > > > > Section 2 "One Message Per Datagram" contains: > > Each syslog UDP datagram MUST contain one and only one syslog > > message. The message MUST be formatted according to the RFC- > > protocol[2]. Additional data MUST NOT be present in the datagram > > payload. > > Doesn't this go against the rules of fragmentation where a > > single udp datagram may contain less than one syslog message? > > (I know what Anton is trying to say here but I don't think > > it's coming out exactly right.) > > I changed this to: > > "Each syslog UDP datagram MUST contain only one syslog message, which > can be complete or truncated. The message MUST be formatted and > truncated according to the RFC-protocol [2]. Additional data MUST > NOT be present in the datagram payload." > > Does this look ok? OK with me. Any other comments? > > > Also, there seems to be a problem with this. > > It seems to state that sending IPv4 hosts don't have to send > > accurate udp checksums but that recieveing IPv4 hosts must > > discard datagrams with inaccurate udp checksums. > > This is correct. I don't see a problem with that. There is a way to distinguish accurate checksum from one that was not computed at all. > > > Use of UDP checksums was defined as optional in RFC 768[1]. > > and > > Syslog senders SHOULD use UDP checksums when sending > > messages over IPv4. > > but then > > Syslog receivers MUST check the checksums whenever they are present > > and discard messages with incorrect checksums. > > As stated in the last sentence, the receivers must only check the checksums whenever they are present. So, if the checksum is 0, it indicates the sender did not compute the checksum per UDP RFC. In this case, we do not require the receiver to discard the message. But if checksums are there, the receiver MUST validate them. > > > Can we get this addressed? (Probably the section should say > > that it is RECOMMENDED that both senders and receivers use > > the checksums. It's probably worth a comment in the Security > > Considerations section as well.) > > I could go for that, it you still think it is needed. Or could just clarify the requirement further. However, I think given a requirement on Internet hosts to support UDP checksums (if not always enabled), it is a good idea to take advantage of that feature for syslog to ensure better robustness. What do you think? Clarity here is good. A clear recommendation for better robustness is also a good thing. :) Thanks, Chris _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:51:58 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id B9C2B19046 for ; Mon, 22 Aug 2005 18:51:58 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:51:58 -0500 (CDT) Received: from xbh-sjc-231.amer.cisco.com ([128.107.191.100]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 8 Jul 2005 09:24:24 -0700 Received: from ind-iport-1.cisco.com ([64.104.129.195]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 8 Jul 2005 09:24:24 -0700 Received: from india-core-1.cisco.com (64.104.129.221) by ind-iport-1.cisco.com with ESMTP; 08 Jul 2005 22:05:28 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,274,1115017200"; d="scan'208"; a="43544506:sNHT27656640" Received: from sj-inbound-d.cisco.com (sj-inbound-d.cisco.com [128.107.243.13]) by india-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j68GKfbV011383; Fri, 8 Jul 2005 16:24:08 GMT Received: from willers.employees.org (192.83.249.36) by sj-inbound-d.cisco.com with ESMTP; 08 Jul 2005 09:23:40 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,274,1115017200"; d="scan'208"; a="90052699:sNHT16261222" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 076F85C81C; Fri, 8 Jul 2005 09:23:19 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-2.cisco.com (sj-iport-2-in.cisco.com [171.71.176.71]) by willers.employees.org (Postfix) with ESMTP id A58C15C734 for ; Fri, 8 Jul 2005 09:23:01 -0700 (PDT) Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-2.cisco.com with ESMTP; 08 Jul 2005 09:23:01 -0700 Received: from sjc-xdm1.cisco.com (sjc-xdm1.cisco.com [171.71.162.58]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j68GMsoe029449; Fri, 8 Jul 2005 09:22:55 -0700 (PDT) Date: Fri, 8 Jul 2005 09:22:59 -0700 (PDT) From: Chris Lonvick To: Rainer Gerhards Subject: RE: [Syslog-sec] Chair Review Comments of draft-ietf-syslog-protocol-13 In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA0E3564@grfint2.intern.adiscon.com> Message-ID: References: <577465F99B41C842AAFBE9ED71E70ABA0E3564@grfint2.intern.adiscon.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Mailman-Approved-At: Fri, 08 Jul 2005 09:23:09 -0700 Cc: syslog-sec@employees.org X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.243.13 X-OriginalArrivalTime: 08 Jul 2005 16:24:24.0295 (UTC) FILETIME=[80DBAF70:01C583D9] Status: RO X-Status: X-Keywords: X-UID: 9 Hi Rainer, I've snipped much of your posting and answered questions below. On Thu, 7 Jul 2005, Rainer Gerhards wrote: > > > > Would it be appropriate in Section 6.2.1 "VERSION" to describe that > > the VERSION field can only be changed by STANDARDS ACTIONS as defined > > in RFC 2434? Also, the VERSION needs to be registered with > > IANA and needs > > to be stated in the instructions to the IANA. > > I've changed it to "Standards Action" in 9.1. Do you think I actually > need to repeat this in 6.2.1? The IANA section needs to be very clear. The IANA people really only look there for their instructions. > > Does 9.2 also require "Standards Action" or is "Specification Required" > (as it is currently) sufficient? I am a bit in doubt, maybe it's better > to keep this consistent. Be consistent. > duplicated to IANA considerations, but mentioning only SD-IDs there. > Which brings up the question: must we put PARAM-Names under > IANA-Control, too? It kind of looks so... Yup. :) > > I think talking about rate-limiting on the receiver's side does not make > so much sense, as it will result in message loss in any case (at least > with UDP transport). Do you think the proposed text is OK? Looks good to me. > > However, this raises a question: should we allow experimental SD-PARAMs > in standardized SD-IDs? Or should these only be allowed in experimental > SD-IDs (x-)? That's a question for the WG. WG Chair hat OFF: I'd suggest putting in a quick statement about allowing "x-" in any SD-IDs. Eveyone: Get your thoughts in quickly on this. > > Chris, I am not sure if the "must" below must be in upper case (as it is > no protocol related thing). I'd appreciate your advise: > > ### > IANA must register the SD-IDs shown in table 4 below. > ### ^^^^ You can leave it lowercase. Thanks, Chris _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:51:59 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 1861419046 for ; Mon, 22 Aug 2005 18:51:59 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:51:59 -0500 (CDT) Received: from xbh-sjc-231.amer.cisco.com ([128.107.191.100]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Jul 2005 08:37:36 -0700 Received: from syd-iport-1.cisco.com ([64.104.193.196]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Jul 2005 08:37:35 -0700 Received: from syd-core-1.cisco.com (64.104.193.198) by syd-iport-1.cisco.com with ESMTP; 12 Jul 2005 02:07:25 +1000 Received: from sj-inbound-e.cisco.com (sj-inbound-e.cisco.com [128.107.243.14]) by syd-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6BFaJ97017266; Tue, 12 Jul 2005 01:36:48 +1000 (EST) Received: from willers.employees.org (192.83.249.36) by sj-inbound-e.cisco.com with ESMTP; 11 Jul 2005 08:37:03 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,279,1115017200"; d="scan'208"; a="94468124:sNHT18856508" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 84F545C77E; Mon, 11 Jul 2005 08:36:54 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from zrtps0kn.nortelnetworks.com (zrtps0kn.nortelnetworks.com [47.140.192.55]) by willers.employees.org (Postfix) with ESMTP id 40C695C753 for ; Mon, 11 Jul 2005 08:36:50 -0700 (PDT) Received: from zcarhxm2.corp.nortel.com (zcarhxm2.corp.nortel.com [47.129.230.99]) by zrtps0kn.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id j6BFahF18881 for ; Mon, 11 Jul 2005 11:36:43 -0400 (EDT) X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 11 Jul 2005 11:36:42 -0400 Message-ID: <713043CE8B8E1348AF3C546DBE02C1B40412A689@zcarhxm2.corp.nortel.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Syslog in Paris? Thread-Index: AcWGLlYOFqCchm61R4aNG8WrKyRFIA== From: "Sharon Chisholm" To: Cc: Subject: [Syslog-sec] Syslog in Paris? X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.243.14 X-OriginalArrivalTime: 11 Jul 2005 15:37:35.0992 (UTC) FILETIME=[7637E780:01C5862E] Status: RO X-Status: X-Keywords: X-UID: 10 hi Will there be a syslog meeting in Paris? It might be a good way to fast track closing off any remaining issues. Sharon Chisholm Nortel=20 Ottawa, Ontario Canada _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:00 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id B594019046 for ; Mon, 22 Aug 2005 18:51:59 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:51:59 -0500 (CDT) Received: from xbh-sjc-221.amer.cisco.com ([128.107.191.63]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Jul 2005 09:22:35 -0700 Received: from syd-iport-1.cisco.com ([64.104.193.196]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Jul 2005 09:22:34 -0700 Received: from syd-core-1.cisco.com (64.104.193.198) by syd-iport-1.cisco.com with ESMTP; 12 Jul 2005 02:52:26 +1000 Received: from sj-inbound-d.cisco.com (sj-inbound-d.cisco.com [128.107.243.13]) by syd-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6BGJr9G022781; Tue, 12 Jul 2005 02:21:48 +1000 (EST) Received: from willers.employees.org (192.83.249.36) by sj-inbound-d.cisco.com with ESMTP; 11 Jul 2005 09:21:50 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,279,1115017200"; d="scan'208"; a="90871347:sNHT25118004" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 72A295C749; Mon, 11 Jul 2005 09:21:33 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-5.cisco.com (sj-iport-5.cisco.com [171.68.10.87]) by willers.employees.org (Postfix) with ESMTP id 1EA375C749 for ; Mon, 11 Jul 2005 09:21:17 -0700 (PDT) Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-5.cisco.com with ESMTP; 11 Jul 2005 09:21:16 -0700 X-IronPort-AV: i="3.93,279,1115017200"; d="scan'208"; a="197517425:sNHT30661884" Received: from sjc-xdm1.cisco.com (sjc-xdm1.cisco.com [171.71.162.58]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j6BGLE6q015238; Mon, 11 Jul 2005 09:21:15 -0700 (PDT) Date: Mon, 11 Jul 2005 09:21:14 -0700 (PDT) From: Chris Lonvick To: Sharon Chisholm Subject: Re: [Syslog-sec] Syslog in Paris? In-Reply-To: <713043CE8B8E1348AF3C546DBE02C1B40412A689@zcarhxm2.corp.nortel.com> Message-ID: References: <713043CE8B8E1348AF3C546DBE02C1B40412A689@zcarhxm2.corp.nortel.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Mailman-Approved-At: Mon, 11 Jul 2005 09:21:26 -0700 Cc: syslog-sec@employees.org X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.243.13 X-OriginalArrivalTime: 11 Jul 2005 16:22:35.0021 (UTC) FILETIME=[BEF70BD0:01C58634] Status: RO X-Status: X-Keywords: X-UID: 11 Hi Sharon, Unfortunately I won't be able to get to Paris this year. I asked for a volunteer to chair the meeting but havn't heard from anyone. (hint, hint :) Thanks, Chris On Mon, 11 Jul 2005, Sharon Chisholm wrote: > hi > > Will there be a syslog meeting in Paris? > > It might be a good way to fast track closing off any remaining issues. > > Sharon Chisholm > Nortel > Ottawa, Ontario > Canada > _______________________________________________ > Syslog-sec mailing list > Syslog-sec@www.employees.org > http://www.employees.org/mailman/listinfo/syslog-sec > _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:00 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 4367619046 for ; Mon, 22 Aug 2005 18:52:00 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:00 -0500 (CDT) Received: from xbh-sjc-231.amer.cisco.com ([128.107.191.100]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Jul 2005 09:32:16 -0700 Received: from sj-iport-3.cisco.com ([171.71.176.72]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Jul 2005 09:32:15 -0700 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-3.cisco.com with ESMTP; 11 Jul 2005 09:32:15 -0700 X-IronPort-AV: i="3.93,279,1115017200"; d="scan'208"; a="300701170:sNHT97092934" Received: from sj-inbound-a.cisco.com (sj-inbound-a.cisco.com [128.107.234.204]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j6BGWBpD020324; Mon, 11 Jul 2005 09:32:15 -0700 (PDT) Received: from willers.employees.org (192.83.249.36) by sj-inbound-a.cisco.com with ESMTP; 11 Jul 2005 09:32:14 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,279,1115017200"; d="scan'208"; a="141386007:sNHT29008680" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id B4D065C7DC; Mon, 11 Jul 2005 09:32:09 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from zcars04e.ca.nortel.com (zcars04e.nortelnetworks.com [47.129.242.56]) by willers.employees.org (Postfix) with ESMTP id 054A25C7D7 for ; Mon, 11 Jul 2005 09:31:57 -0700 (PDT) Received: from zcarhxm2.corp.nortel.com (zcarhxm2.corp.nortel.com [47.129.230.99]) by zcars04e.ca.nortel.com (Switch-2.2.0/Switch-2.2.0) with ESMTP id j6BGUa929962; Mon, 11 Jul 2005 12:30:36 -0400 (EDT) X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Syslog-sec] Syslog in Paris? Date: Mon, 11 Jul 2005 12:31:53 -0400 Message-ID: <713043CE8B8E1348AF3C546DBE02C1B40412A74F@zcarhxm2.corp.nortel.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Syslog-sec] Syslog in Paris? Thread-Index: AcWGNJLSlNXiDaDBRn+IutktK05rvAAAWsaw From: "Sharon Chisholm" To: "Chris Lonvick" Cc: syslog-sec@employees.org X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-OriginalArrivalTime: 11 Jul 2005 16:32:15.0857 (UTC) FILETIME=[192B9610:01C58636] Status: RO X-Status: X-Keywords: X-UID: 12 hi If there is sufficient interest I could chair something. Sharon -----Original Message----- From: Chris Lonvick [mailto:clonvick@cisco.com]=20 Sent: Monday, July 11, 2005 12:21 PM To: Chisholm, Sharon [CAR:5K50:EXCH] Cc: syslog-sec@employees.org Subject: Re: [Syslog-sec] Syslog in Paris? Hi Sharon, Unfortunately I won't be able to get to Paris this year. I asked for a volunteer to chair the meeting but havn't heard from anyone. (hint, hint :) Thanks, Chris On Mon, 11 Jul 2005, Sharon Chisholm wrote: > hi > > Will there be a syslog meeting in Paris? > > It might be a good way to fast track closing off any remaining issues. > > Sharon Chisholm > Nortel > Ottawa, Ontario > Canada > _______________________________________________ > Syslog-sec mailing list > Syslog-sec@www.employees.org=20 > http://www.employees.org/mailman/listinfo/syslog-sec > _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From list-owner-incoming-ietf-announce@sj-core-5.cisco.com Mon Aug 22 18:52:00 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id B029E19046 for ; Mon, 22 Aug 2005 18:52:00 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:00 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 14 Jul 2005 08:03:34 -0700 Received: from sj-iport-2.cisco.com ([171.71.176.71]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 14 Jul 2005 08:03:34 -0700 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-2.cisco.com with ESMTP; 14 Jul 2005 08:03:34 -0700 Received: from sj-inbound-b.cisco.com (sj-inbound-b.cisco.com [128.107.234.205]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j6EF3LVZ005155; Thu, 14 Jul 2005 08:03:26 -0700 (PDT) Received: from megatron.ietf.org (132.151.6.71) by sj-inbound-b.cisco.com with ESMTP; 14 Jul 2005 08:03:02 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,290,1115017200"; d="txt'208?scan'208,208"; a="82390466:sNHT34133024" Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Dt52Q-0007zR-Pw; Thu, 14 Jul 2005 10:50:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1Dt52J-0007xd-DB for i-d-announce@megatron.ietf.org; Thu, 14 Jul 2005 10:50:03 -0400 Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA15481 for ; Thu, 14 Jul 2005 10:50:00 -0400 (EDT) Received: from [132.151.6.50] (helo=newodin.ietf.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1Dt5Uv-0004BY-Rr for i-d-announce@ietf.org; Thu, 14 Jul 2005 11:19:38 -0400 Received: from mlee by newodin.ietf.org with local (Exim 4.43) id 1Dt52H-0004Sg-Rs; Thu, 14 Jul 2005 10:50:01 -0400 Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Message-Id: Date: Thu, 14 Jul 2005 10:50:01 -0400 X-Spam-Score: 0.4 (/) X-Scan-Signature: 5011df3e2a27abcc044eaa15befcaa87 Cc: syslog-sec@employees.org Subject: I-D ACTION:draft-ietf-syslog-protocol-14.txt X-BeenThere: i-d-announce@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: internet-drafts@ietf.org List-Id: i-d-announce.ietf.org List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: i-d-announce-bounces@ietf.org Errors-To: i-d-announce-bounces@ietf.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.234.205 X-OriginalArrivalTime: 14 Jul 2005 15:03:34.0295 (UTC) FILETIME=[3482EA70:01C58885] Status: RO X-Status: X-Keywords: X-UID: 13 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Security Issues in Network Event Logging Working Group of the IETF. Title : The syslog Protocol Author(s) : R. Gerhards Filename : draft-ietf-syslog-protocol-14.txt Pages : 47 Date : 2005-7-14 This document describes the syslog protocol, which is used to convey event notification messages. This protocol utilizes a layered architecture, which allows the use of any number of transport protocols for transmission of syslog messages. It also provides a message format that allows vendor-specific extensions to be provided in a structured way. This document has been written with the spirit of traditional syslog in mind. The reason for a new layered specification has arisen because standardization efforts for reliable, and secure syslog extensions suffer from the lack of a standards-track and transport independent RFC. Without this document, each other standard needs to define its own syslog packet format and transport mechanism, which over time will introduce subtle compatibility issues. This document tries to provide a foundation that syslog extensions can build on. The layered architecture also provides a solid basis that allows code to be written once instead of multiple times, once for each syslog feature. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-14.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-syslog-protocol-14.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-syslog-protocol-14.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. ------------------------------------------------------------------------- CONTENT ABOVE THIS LINE IS *NOT* FROM CISCO INFORMATION TECHNOLOGY ------------------------------------------------------------------------- In order to maintain computing infrastructure integrity, Cisco Systems Enterprise Messaging Services and InfoSec teams have set a mail policy disallowing executable attachments in email. This message contained an executable attachment type that is prohibited by this policy. The attachment has been removed from this message and copied to quarantine by our systems. It will be held in quarantine for seven days in the event that the content needs to be retrieved. Please be aware many viruses attempt to look like legitimate email or notifications from anti-virus systems. We will clearly mark a seperation between our notifications and the original email as follows: "CONTENT ABOVE THIS LINE IS *NOT* FROM CISCO INFORMATION TECHNOLOGY" For further reference information about viruses and email antivirus efforts within Cisco, please visit: http://wwwin.cisco.com/it/ems/services/antiviral If your concern isn't addressed by the information in this notification or the above web page, you may open a support request: http://wwwin.cisco.com/support/ Select "Messaging", "Email-Related", "Mail Routing" Please include in the text of your case the following information: * Full headers of the message. Documentation on displaying the full headers is available at this URL: http://wwwin.cisco.com/support/library/faqs/solution002471.html * This unique quarantine identifier: j6EF3LVZ005155 If the matter is urgent, you may follow up by calling one of the below referenced numbers. Please make every effort to provide the above requested information via the support web tool prior to calling as it will greatly aid the resolution of your issue. Americas: 1 408 526 8888 Asiapac +61 2 8446 8888 EMEA +31 20 485 4888 Japan +81 3 5549 6888 US (Toll Free) 1| 800| 888| 8187| (ext.68888) Thank you for your cooperation, Enterprise Messaging Services Cisco Systems, Inc --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ I-D-Announce mailing list I-D-Announce@ietf.org https://www1.ietf.org/mailman/listinfo/i-d-announce --OtherAccess-- --NextPart-- From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:01 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 3239319046 for ; Mon, 22 Aug 2005 18:52:01 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:01 -0500 (CDT) Received: from xbh-sjc-221.amer.cisco.com ([128.107.191.63]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 14 Jul 2005 09:08:50 -0700 Received: from syd-iport-1.cisco.com ([64.104.193.196]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 14 Jul 2005 09:08:49 -0700 Received: from syd-core-1.cisco.com (64.104.193.198) by syd-iport-1.cisco.com with ESMTP; 15 Jul 2005 02:39:24 +1000 Received: from sj-inbound-a.cisco.com (sj-inbound-a.cisco.com [128.107.234.204]) by syd-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6EG7e95002683; Fri, 15 Jul 2005 02:07:59 +1000 (EST) Received: from willers.employees.org (192.83.249.36) by sj-inbound-a.cisco.com with ESMTP; 14 Jul 2005 09:08:12 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,290,1115017200"; d="scan'208"; a="143350161:sNHT20044128" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id DE1EB5C86B; Thu, 14 Jul 2005 09:07:19 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from newodin.ietf.org (unknown [132.151.6.50]) by willers.employees.org (Postfix) with ESMTP id 0B8955C763 for ; Thu, 14 Jul 2005 07:50:03 -0700 (PDT) Received: from mlee by newodin.ietf.org with local (Exim 4.43) id 1Dt52H-0004Sg-Rs; Thu, 14 Jul 2005 10:50:01 -0400 Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Message-Id: Date: Thu, 14 Jul 2005 10:50:01 -0400 X-Mailman-Approved-At: Thu, 14 Jul 2005 09:07:07 -0700 X-Content-Filtered-By: Mailman/MimeDel 2.1.4 Cc: syslog-sec@employees.org Subject: [Syslog-sec] I-D ACTION:draft-ietf-syslog-protocol-14.txt X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.234.204 X-OriginalArrivalTime: 14 Jul 2005 16:08:50.0111 (UTC) FILETIME=[528504F0:01C5888E] Status: RO X-Status: X-Keywords: X-UID: 14 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Security Issues in Network Event Logging Working Group of the IETF. Title : The syslog Protocol Author(s) : R. Gerhards Filename : draft-ietf-syslog-protocol-14.txt Pages : 47 Date : 2005-7-14 This document describes the syslog protocol, which is used to convey event notification messages. This protocol utilizes a layered architecture, which allows the use of any number of transport protocols for transmission of syslog messages. It also provides a message format that allows vendor-specific extensions to be provided in a structured way. This document has been written with the spirit of traditional syslog in mind. The reason for a new layered specification has arisen because standardization efforts for reliable, and secure syslog extensions suffer from the lack of a standards-track and transport independent RFC. Without this document, each other standard needs to define its own syslog packet format and transport mechanism, which over time will introduce subtle compatibility issues. This document tries to provide a foundation that syslog extensions can build on. The layered architecture also provides a solid basis that allows code to be written once instead of multiple times, once for each syslog feature. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-14.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-syslog-protocol-14.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-syslog-protocol-14.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec --NextPart-- From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:01 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id B025619046 for ; Mon, 22 Aug 2005 18:52:01 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:01 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 19 Jul 2005 21:43:11 -0700 Received: from sj-iport-5.cisco.com ([171.68.10.87]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 19 Jul 2005 21:43:26 -0700 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-5.cisco.com with ESMTP; 19 Jul 2005 21:43:11 -0700 X-IronPort-AV: i="3.93,301,1115017200"; d="scan'208"; a="199381368:sNHT51751948" Received: from sj-inbound-c.cisco.com (sj-inbound-c.cisco.com [128.107.234.206]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j6K4gN7C013819; Tue, 19 Jul 2005 21:43:06 -0700 (PDT) Received: from willers.employees.org (192.83.249.36) by sj-inbound-c.cisco.com with ESMTP; 19 Jul 2005 21:43:05 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,301,1115017200"; d="scan'208"; a="82534915:sNHT16554340" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 0688E5C760; Tue, 19 Jul 2005 21:42:56 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-4.cisco.com (sj-iport-4.cisco.com [171.68.10.86]) by willers.employees.org (Postfix) with ESMTP id EA1075C75C for ; Tue, 19 Jul 2005 21:35:01 -0700 (PDT) Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-4.cisco.com with ESMTP; 19 Jul 2005 21:35:03 -0700 Received: from sjc-xdm1.cisco.com (sjc-xdm1.cisco.com [171.71.162.58]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j6K4Z06q010564 for ; Tue, 19 Jul 2005 21:35:00 -0700 (PDT) Date: Tue, 19 Jul 2005 21:34:59 -0700 (PDT) From: Chris Lonvick To: syslog-sec@employees.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Mailman-Approved-At: Tue, 19 Jul 2005 21:42:55 -0700 Cc: Subject: [Syslog-sec] Start of WG Last Call on draft-ietf-syslog-protocol-14.txt X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.234.206 X-OriginalArrivalTime: 20 Jul 2005 04:43:26.0027 (UTC) FILETIME=[912249B0:01C58CE5] Status: RO X-Status: X-Keywords: X-UID: 15 Hi Folks, This message marks the start of a Working Group Last Call on draft-ietf-syslog-protocol-14.txt, "The syslog Protocol", for publication as an Proposed Standard. This last call period expires on August 5th, 2005 (extended to the end of the IETF meeting week). During this Last Call period, comments supporting publication are encouraged as are comments pointing out problems or suggesting changes to the specification. Reports of successful implementation of this draft are encouraged. As a reminder, tests of interoperability are *not* a prerequisite for publication as Proposed Standard but any obstacles to implementation or specification ambiguities should be corrected before publication. Please send comments to the WG list as a whole. Reports of minor problems (typos) will not delay advancement of this document. Thanks, Chris _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:02 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 22EE519046 for ; Mon, 22 Aug 2005 18:52:02 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:02 -0500 (CDT) Received: from xbh-sjc-221.amer.cisco.com ([128.107.191.63]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 19 Jul 2005 21:44:19 -0700 Received: from ams-iport-1.cisco.com ([144.254.224.140]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 19 Jul 2005 21:44:35 -0700 Received: from ams-core-1.cisco.com (144.254.224.150) by ams-iport-1.cisco.com with ESMTP; 20 Jul 2005 06:44:17 +0200 Received: from sj-inbound-e.cisco.com (sj-inbound-e.cisco.com [128.107.243.14]) by ams-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6K4hHE1016445; Wed, 20 Jul 2005 06:44:09 +0200 (MEST) Received: from willers.employees.org (192.83.249.36) by sj-inbound-e.cisco.com with ESMTP; 19 Jul 2005 21:43:45 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,301,1115017200"; d="scan'208"; a="97531399:sNHT15398780" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 8DA7E5C7D1; Tue, 19 Jul 2005 21:43:00 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-5.cisco.com (sj-iport-5.cisco.com [171.68.10.87]) by willers.employees.org (Postfix) with ESMTP id 953E15C784 for ; Tue, 19 Jul 2005 21:41:56 -0700 (PDT) Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-5.cisco.com with ESMTP; 19 Jul 2005 21:41:57 -0700 X-IronPort-AV: i="3.93,301,1115017200"; d="scan'208"; a="199381269:sNHT24382752" Received: from sjc-xdm1.cisco.com (sjc-xdm1.cisco.com [171.71.162.58]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j6K4fs6q013732 for ; Tue, 19 Jul 2005 21:41:55 -0700 (PDT) Date: Tue, 19 Jul 2005 21:41:54 -0700 (PDT) From: Chris Lonvick To: syslog-sec@employees.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Mailman-Approved-At: Tue, 19 Jul 2005 21:42:55 -0700 Cc: Subject: [Syslog-sec] Start of WG Last Call on draft-ietf-syslog-transport-udp-05.txt X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.243.14 X-OriginalArrivalTime: 20 Jul 2005 04:44:35.0343 (UTC) FILETIME=[BA7311F0:01C58CE5] Status: RO X-Status: X-Keywords: X-UID: 16 Hi Folks, This message marks the start of a Working Group Last Call on draft-ietf-syslog-transport-udp-05.txt, "Transmission of syslog messages over UDP", for publication as an Proposed Standard. This last call period expires on August 5th, 2005 (extended to the end of the IETF meeting week). During this Last Call period, comments supporting publication are encouraged as are comments pointing out problems or suggesting changes to the specification. Reports of successful implementation of this draft are encouraged. As a reminder, tests of interoperability are *not* a prerequisite for publication as Proposed Standard but any obstacles to implementation or specification ambiguities should be corrected before publication. Please send comments to the WG list as a whole. Reports of minor problems (typos) will not delay advancement of this document. Thanks, Chris _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:02 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 8E9E319046 for ; Mon, 22 Aug 2005 18:52:02 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:02 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Jul 2005 00:34:05 -0700 Received: from ams-iport-1.cisco.com ([144.254.224.140]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Jul 2005 00:34:05 -0700 Received: from ams-core-1.cisco.com (144.254.224.150) by ams-iport-1.cisco.com with ESMTP; 11 Jul 2005 09:34:02 +0200 Received: from sj-inbound-c.cisco.com (sj-inbound-c.cisco.com [128.107.234.206]) by ams-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6B7XMDq003632; Mon, 11 Jul 2005 09:33:54 +0200 (MEST) Received: from willers.employees.org (192.83.249.36) by sj-inbound-c.cisco.com with ESMTP; 11 Jul 2005 00:33:48 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,278,1115017200"; d="scan'208"; a="79978328:sNHT19362772" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id E43015C7A7; Mon, 11 Jul 2005 00:33:41 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from ipx10102.ipxserver.de (mailin.adiscon.com [80.190.240.92]) by willers.employees.org (Postfix) with ESMTP id 058A15C77F for ; Mon, 11 Jul 2005 00:33:39 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by ipx10102.ipxserver.de (Postfix) with ESMTP id 3D1DF1B00B7 for ; Mon, 11 Jul 2005 09:33:21 +0200 (CEST) Received: from ipx10102.ipxserver.de ([127.0.0.1]) by localhost (ipx10102 [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 28097-01 for ; Mon, 11 Jul 2005 09:33:17 +0200 (CEST) Received: from fmint2.intern.adiscon.com (pD95B68D5.dip0.t-ipconnect.de [217.91.104.213]) by ipx10102.ipxserver.de (Postfix) with ESMTP id B608E1B0066 for ; Mon, 11 Jul 2005 09:33:16 +0200 (CEST) Received: from grfint2.intern.adiscon.com ([172.19.0.6]) by fmint2.intern.adiscon.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 11 Jul 2005 09:33:14 +0200 Content-class: urn:content-classes:message Subject: RE: [Syslog-sec] Chair Review Comments of draft-ietf-syslog-protocol-13 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 11 Jul 2005 09:33:11 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Message-ID: <577465F99B41C842AAFBE9ED71E70ABA0E3586@grfint2.intern.adiscon.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Syslog-sec] Chair Review Comments of draft-ietf-syslog-protocol-13 Thread-Index: AcWD2VuwoWUmbMPVSVuN3rwCaLpVcQCDVQEg From: "Rainer Gerhards" To: X-OriginalArrivalTime: 11 Jul 2005 07:33:14.0414 (UTC) FILETIME=[CC2B04E0:01C585EA] X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at adiscon.com Cc: X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.234.206 Status: RO X-Status: X-Keywords: X-UID: 17 > The IANA section needs to be very clear. The IANA people=20 > really only look > there for their instructions. I have re-worked the IANA Considerations a little. Some information is now a duplicate of the HEADER description, but in the light of Chris' comment, this makes sense to me. The text also contains a change related to Chris issue with x- PARAM-NAMES - see below.=20 The new text is as follows: ### 9. IANA Considerations 9.1 VERSION IANA must maintain a registry of VERSION values as described in Section 6.2.1. Version numbers MUST be incremented for any new syslog protocol specification that changes any part of the HEADER. Changes include addition or removal of fields or a change of syntax or semantics of existing fields. VERSION numbers must be registered via the Standards Action method as described in RFC 2434 [9]. IANA must register the VERSIONs shown in table 4 below. VERSION FORMAT 1 according to this document Table 4. IANA-registered VERSIONs. 9.2 SD-IDs IANA must maintain a registry of Structured Data ID (SD-ID) values together with their associated PARAM-NAME values as described in Section 7. New SD-ID and new PARAM-NAME values must be registered through the Standards Action method as described in RFC 2434 [9]. Once SD-IDs and SD-PARAMs are defined, syntax and semantics of these objects MUST NOT be altered. Should a change to an existing object be desired, a new SD-ID or SD-PARAM MUST be created and the old one remain unchanged. SD-IDs and PARAM-NAMEs with the prefatory string "x-" (without the quotes) are reserved for experimental use. IANA must not register any SD-ID or PARAM-NAME with the prefatory string "x-" for any other use. IANA must register the SD-IDs and PARAM-NAMEs shown in table 5 below. SD-ID PARAM-NAME timeQuality OPTIONAL tzKnown OPTIONAL isSynced OPTIONAL syncAccuracy OPTIONAL origin OPTIONAL ip OPTIONAL enterpriseId OPTIONAL software OPTIONAL swVersion OPTIONAL meta OPTIONAL sequenceId OPTIONAL sysUpTime OPTIONAL x- (prefatory RESERVED for experimental SD-IDs string) (any) x- (prefatory reserved for experimental string) PARAM-NAMEs Table 5. IANA-registered SD-IDs and their PARAM-NAMEs. ### >=20 >=20 > > > > However, this raises a question: should we allow=20 > experimental SD-PARAMs > > in standardized SD-IDs? Or should these only be allowed in=20 > experimental > > SD-IDs (x-)? >=20 > That's a question for the WG. >=20 > WG Chair hat OFF: > I'd suggest putting in a quick statement about allowing=20 > "x-" in > any SD-IDs. > Eveyone: Get your thoughts in quickly on this. I agree to Chris suggestion. I have modified the text as follows: ### 6.3.3 SD-PARAM Each SD-PARAM consist of a name, referred to as PARAM-NAME, and a value, referred to as PARAM-VALUE. PARAM-NAME is case-sensitive. IANA controls all PARAM-NAMEs, with the exception of those in experimental SD-IDs or those with the prefatory string "x-" (without the quotes). PARAM-NAMEs with the prefatory string x- are set aside for experimental purposes. They can be specified in any SD-ID. The PARAM-NAME scope is within a specific SD-ID. Thus, an equally-named PARAM-NAME contained in two different SD-IDs is not the same. ### I will publish this version tomorrow if I do not receive any more comments requesting change. Rainer _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:03 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 0367519046 for ; Mon, 22 Aug 2005 18:52:03 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:03 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Jul 2005 09:35:32 -0700 Received: from ams-iport-1.cisco.com ([144.254.224.140]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Jul 2005 09:35:31 -0700 Received: from ams-core-1.cisco.com (144.254.224.150) by ams-iport-1.cisco.com with ESMTP; 11 Jul 2005 18:35:29 +0200 Received: from sj-inbound-e.cisco.com (sj-inbound-e.cisco.com [128.107.243.14]) by ams-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6BGYDDw011245; Mon, 11 Jul 2005 18:35:21 +0200 (MEST) Received: from willers.employees.org (192.83.249.36) by sj-inbound-e.cisco.com with ESMTP; 11 Jul 2005 09:34:59 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,279,1115017200"; d="scan'208"; a="94486940:sNHT15476012" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 77AA95C773; Mon, 11 Jul 2005 09:34:58 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-3.cisco.com (sj-iport-3-in.cisco.com [171.71.176.72]) by willers.employees.org (Postfix) with ESMTP id 0A9815C770 for ; Mon, 11 Jul 2005 09:34:45 -0700 (PDT) Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-3.cisco.com with ESMTP; 11 Jul 2005 09:34:43 -0700 X-IronPort-AV: i="3.93,279,1115017200"; d="scan'208"; a="300704814:sNHT1553785136" Received: from sjc-xdm1.cisco.com (sjc-xdm1.cisco.com [171.71.162.58]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6BGYevN008928 for ; Mon, 11 Jul 2005 09:34:40 -0700 (PDT) Date: Mon, 11 Jul 2005 09:34:42 -0700 (PDT) From: Chris Lonvick To: syslog-sec@employees.org In-Reply-To: <713043CE8B8E1348AF3C546DBE02C1B40412A74F@zcarhxm2.corp.nortel.com> Message-ID: References: <713043CE8B8E1348AF3C546DBE02C1B40412A74F@zcarhxm2.corp.nortel.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Mailman-Approved-At: Mon, 11 Jul 2005 09:34:56 -0700 Cc: Subject: [Syslog-sec] Agenda Items for a meeting in Paris? X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.243.14 X-OriginalArrivalTime: 11 Jul 2005 16:35:31.0906 (UTC) FILETIME=[8E064A20:01C58636] Status: RO X-Status: X-Keywords: X-UID: 18 Hi Folks, Are there agenda items for a meeting in Paris? Please get them in quickly and let's see if we want to hold a meeting. Many thanks, Chris _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:03 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 6EA7A19046 for ; Mon, 22 Aug 2005 18:52:03 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:03 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Jul 2005 09:40:28 -0700 Received: from ams-iport-1.cisco.com ([144.254.224.140]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Jul 2005 09:40:27 -0700 Received: from ams-core-1.cisco.com (144.254.224.150) by ams-iport-1.cisco.com with ESMTP; 11 Jul 2005 18:40:09 +0200 Received: from sj-inbound-d.cisco.com (sj-inbound-d.cisco.com [128.107.243.13]) by ams-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6BGcGE1012061; Mon, 11 Jul 2005 18:40:00 +0200 (MEST) Received: from willers.employees.org (192.83.249.36) by sj-inbound-d.cisco.com with ESMTP; 11 Jul 2005 09:39:51 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,279,1115017200"; d="scan'208"; a="90877715:sNHT17088148" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id C29045C750; Mon, 11 Jul 2005 09:39:37 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from ipx10102.ipxserver.de (mailin.adiscon.com [80.190.240.92]) by willers.employees.org (Postfix) with ESMTP id 88EB65C7F5 for ; Mon, 11 Jul 2005 09:39:18 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by ipx10102.ipxserver.de (Postfix) with ESMTP id E66C61B0077 for ; Mon, 11 Jul 2005 18:39:24 +0200 (CEST) Received: from ipx10102.ipxserver.de ([127.0.0.1]) by localhost (ipx10102 [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 04768-09 for ; Mon, 11 Jul 2005 18:39:18 +0200 (CEST) Received: from fmint2.intern.adiscon.com (pD95B68D5.dip0.t-ipconnect.de [217.91.104.213]) by ipx10102.ipxserver.de (Postfix) with ESMTP id 871851B0007 for ; Mon, 11 Jul 2005 18:39:18 +0200 (CEST) Received: from grfint2.intern.adiscon.com ([172.19.0.6]) by fmint2.intern.adiscon.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 11 Jul 2005 18:39:10 +0200 Content-class: urn:content-classes:message Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 11 Jul 2005 18:39:07 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Message-ID: <577465F99B41C842AAFBE9ED71E70ABA0E35A9@grfint2.intern.adiscon.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Syslog-sec] Agenda Items for a meeting in Paris? Thread-Index: AcWGNoZ6TUQQh7NqSS+tV/eFaqqSiwAAHNhA From: "Rainer Gerhards" To: X-OriginalArrivalTime: 11 Jul 2005 16:39:10.0626 (UTC) FILETIME=[10645020:01C58637] X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at adiscon.com Cc: X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.243.13 Status: RO X-Status: X-Keywords: X-UID: 19 I think if there is no comment to the thing I posted this morning, there is probably no other issue... Rainer=20 > -----Original Message----- > From: syslog-sec-bounces@www.employees.org=20 > [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of=20 > Chris Lonvick > Sent: Monday, July 11, 2005 6:35 PM > To: syslog-sec@employees.org > Subject: [Syslog-sec] Agenda Items for a meeting in Paris? >=20 > Hi Folks, >=20 > Are there agenda items for a meeting in Paris? > Please get them in quickly and let's see if we > want to hold a meeting. >=20 > Many thanks, > Chris > _______________________________________________ > Syslog-sec mailing list > Syslog-sec@www.employees.org > http://www.employees.org/mailman/listinfo/syslog-sec >=20 _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:05 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 8256E19046 for ; Mon, 22 Aug 2005 18:52:05 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:05 -0500 (CDT) Received: from xbh-sjc-231.amer.cisco.com ([128.107.191.100]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 12 Jul 2005 06:34:49 -0700 Received: from rtp-iport-2.cisco.com ([64.102.122.149]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 12 Jul 2005 06:34:49 -0700 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-2.cisco.com with ESMTP; 12 Jul 2005 09:34:41 -0400 X-IronPort-AV: i="3.93,283,1115006400"; d="scan'208"; a="61971011:sNHT61637078" Received: from sj-inbound-b.cisco.com (sj-inbound-b.cisco.com [128.107.234.205]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6CDYWkI000260; Tue, 12 Jul 2005 09:34:39 -0400 (EDT) Received: from willers.employees.org (192.83.249.36) by sj-inbound-b.cisco.com with ESMTP; 12 Jul 2005 06:34:39 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,283,1115017200"; d="scan'208"; a="81692024:sNHT20799864" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 2A6A45C7DE; Tue, 12 Jul 2005 06:34:34 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from zcars04f.nortelnetworks.com (zcars04f.nortelnetworks.com [47.129.242.57]) by willers.employees.org (Postfix) with ESMTP id 3FDB55C7AD for ; Tue, 12 Jul 2005 06:34:30 -0700 (PDT) Received: from zcarhxm2.corp.nortel.com (zcarhxm2.corp.nortel.com [47.129.230.99]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id j6CDYMS06312 for ; Tue, 12 Jul 2005 09:34:22 -0400 (EDT) Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? Date: Tue, 12 Jul 2005 09:34:09 -0400 Message-ID: <713043CE8B8E1348AF3C546DBE02C1B40412ADC9@zcarhxm2.corp.nortel.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Syslog-sec] Agenda Items for a meeting in Paris? thread-index: AcWGNoZ6TUQQh7NqSS+tV/eFaqqSiwAAHNhAACunLEA= From: "Sharon Chisholm" To: Cc: X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-OriginalArrivalTime: 12 Jul 2005 13:34:49.0619 (UTC) FILETIME=[79EE5630:01C586E6] Status: RO X-Status: X-Keywords: X-UID: 20 hi Version -13 of the draft reflects the original severity mapping, but in the email I sent on June 29th, I proposed a compromise between this and the proposed changes by Alex. Do we have agreement to make this changes? Sharon=20 -----Original Message----- From: syslog-sec-bounces@willers.employees.org [mailto:syslog-sec-bounces@willers.employees.org] On Behalf Of Rainer Gerhards Sent: Monday, July 11, 2005 12:39 PM To: syslog-sec@employees.org Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? I think if there is no comment to the thing I posted this morning, there is probably no other issue... Rainer=20 > -----Original Message----- > From: syslog-sec-bounces@www.employees.org > [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of=20 > Chris Lonvick > Sent: Monday, July 11, 2005 6:35 PM > To: syslog-sec@employees.org > Subject: [Syslog-sec] Agenda Items for a meeting in Paris? >=20 > Hi Folks, >=20 > Are there agenda items for a meeting in Paris? > Please get them in quickly and let's see if we > want to hold a meeting. >=20 > Many thanks, > Chris > _______________________________________________ > Syslog-sec mailing list > Syslog-sec@www.employees.org=20 > http://www.employees.org/mailman/listinfo/syslog-sec >=20 _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:05 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id D2D5119046 for ; Mon, 22 Aug 2005 18:52:05 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:05 -0500 (CDT) Received: from xbh-sjc-221.amer.cisco.com ([128.107.191.63]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 12 Jul 2005 06:39:49 -0700 Received: from ind-iport-1.cisco.com ([64.104.129.195]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 12 Jul 2005 06:39:49 -0700 Received: from india-core-1.cisco.com (64.104.129.221) by ind-iport-1.cisco.com with ESMTP; 12 Jul 2005 19:21:31 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,283,1115017200"; d="scan'208"; a="44048431:sNHT32635948" Received: from sj-inbound-a.cisco.com (sj-inbound-a.cisco.com [128.107.234.204]) by india-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6CDd0bD011887; Tue, 12 Jul 2005 13:39:19 GMT Received: from willers.employees.org (192.83.249.36) by sj-inbound-a.cisco.com with ESMTP; 12 Jul 2005 06:39:05 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,283,1115017200"; d="scan'208"; a="141930384:sNHT18146456" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 57A615C7CD; Tue, 12 Jul 2005 06:38:58 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from ipx10102.ipxserver.de (mailin.adiscon.com [80.190.240.92]) by willers.employees.org (Postfix) with ESMTP id 0BCAF5C74A for ; Tue, 12 Jul 2005 06:38:52 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by ipx10102.ipxserver.de (Postfix) with ESMTP id 8E7791B00AF for ; Tue, 12 Jul 2005 15:38:56 +0200 (CEST) Received: from ipx10102.ipxserver.de ([127.0.0.1]) by localhost (ipx10102 [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 17008-05 for ; Tue, 12 Jul 2005 15:38:51 +0200 (CEST) Received: from fmint2.intern.adiscon.com (pD95B68D5.dip0.t-ipconnect.de [217.91.104.213]) by ipx10102.ipxserver.de (Postfix) with ESMTP id F13AC1B00A9 for ; Tue, 12 Jul 2005 15:38:50 +0200 (CEST) Received: from grfint2.intern.adiscon.com ([172.19.0.6]) by fmint2.intern.adiscon.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 12 Jul 2005 15:38:44 +0200 Content-class: urn:content-classes:message Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Tue, 12 Jul 2005 15:38:27 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Message-ID: <577465F99B41C842AAFBE9ED71E70ABA0E35CB@grfint2.intern.adiscon.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Syslog-sec] Agenda Items for a meeting in Paris? Thread-Index: AcWGNoZ6TUQQh7NqSS+tV/eFaqqSiwAAHNhAACunLEAAAD6IcA== From: "Rainer Gerhards" To: X-OriginalArrivalTime: 12 Jul 2005 13:38:44.0820 (UTC) FILETIME=[061F2940:01C586E7] X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at adiscon.com Cc: X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.234.204 Status: RO X-Status: X-Keywords: X-UID: 21 Hi Sharon,=20 nobody objected your proposal and I changed it in -14, sent this morning to the draft editor. The change was also in my (long;)) mail from Jul, 7th, again with no objects (mail link below). http://www.mail-archive.com/syslog-sec%40www.employees.org/msg00267.html So I think we reached agreement. I've put up a preliminary copy of -14 for your information, as the draft editor probably is very busy right now. It is available at: http://www.syslog.cc/ietf/drafts/draft-ietf-syslog-protocol-14.txt Rainer > -----Original Message----- > From: syslog-sec-bounces@www.employees.org=20 > [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of=20 > Sharon Chisholm > Sent: Tuesday, July 12, 2005 3:34 PM > To: syslog-sec@employees.org > Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? >=20 > hi >=20 > Version -13 of the draft reflects the original severity=20 > mapping, but in > the email I sent on June 29th, I proposed a compromise=20 > between this and > the proposed changes by Alex. >=20 > Do we have agreement to make this changes? >=20 > Sharon=20 >=20 > -----Original Message----- > From: syslog-sec-bounces@willers.employees.org > [mailto:syslog-sec-bounces@willers.employees.org] On Behalf Of Rainer > Gerhards > Sent: Monday, July 11, 2005 12:39 PM > To: syslog-sec@employees.org > Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? >=20 >=20 > I think if there is no comment to the thing I posted this=20 > morning, there > is probably no other issue... >=20 > Rainer=20 >=20 > > -----Original Message----- > > From: syslog-sec-bounces@www.employees.org > > [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of=20 > > Chris Lonvick > > Sent: Monday, July 11, 2005 6:35 PM > > To: syslog-sec@employees.org > > Subject: [Syslog-sec] Agenda Items for a meeting in Paris? > >=20 > > Hi Folks, > >=20 > > Are there agenda items for a meeting in Paris? > > Please get them in quickly and let's see if we > > want to hold a meeting. > >=20 > > Many thanks, > > Chris > > _______________________________________________ > > Syslog-sec mailing list > > Syslog-sec@www.employees.org=20 > > http://www.employees.org/mailman/listinfo/syslog-sec > >=20 > _______________________________________________ > Syslog-sec mailing list > Syslog-sec@www.employees.org > http://www.employees.org/mailman/listinfo/syslog-sec >=20 > _______________________________________________ > Syslog-sec mailing list > Syslog-sec@www.employees.org > http://www.employees.org/mailman/listinfo/syslog-sec >=20 _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:06 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 15CA319046 for ; Mon, 22 Aug 2005 18:52:06 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:06 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 12 Jul 2005 10:57:19 -0700 Received: from rtp-iport-1.cisco.com ([64.102.122.148]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 12 Jul 2005 10:57:19 -0700 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-1.cisco.com with ESMTP; 12 Jul 2005 10:57:14 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,283,1115017200"; d="scan'208"; a="1477528:sNHT34950370" Received: from sj-inbound-e.cisco.com (sj-inbound-e.cisco.com [128.107.243.14]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6CHv6kF014257; Tue, 12 Jul 2005 13:57:13 -0400 (EDT) Received: from willers.employees.org (192.83.249.36) by sj-inbound-e.cisco.com with ESMTP; 12 Jul 2005 10:57:06 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,283,1115017200"; d="scan'208"; a="94894443:sNHT22357604" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 0EB565C798; Tue, 12 Jul 2005 10:57:02 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-3.cisco.com (sj-iport-3-in.cisco.com [171.71.176.72]) by willers.employees.org (Postfix) with ESMTP id 498EE5C74D for ; Tue, 12 Jul 2005 10:56:59 -0700 (PDT) Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-3.cisco.com with ESMTP; 12 Jul 2005 10:56:59 -0700 X-IronPort-AV: i="3.93,283,1115017200"; d="scan'208"; a="302692346:sNHT160580834" Received: from xbh-sjc-221.amer.cisco.com (xbh-sjc-221.cisco.com [128.107.191.63]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j6CHuSVn026284; Tue, 12 Jul 2005 10:56:56 -0700 (PDT) Received: from xmb-sjc-236.amer.cisco.com ([128.107.191.121]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 12 Jul 2005 10:56:43 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? Date: Tue, 12 Jul 2005 10:56:42 -0700 Message-ID: <85B2F271FDF6B949B3672BA5A7BB62FB5AE01D@xmb-sjc-236.amer.cisco.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Syslog-sec] Agenda Items for a meeting in Paris? Thread-Index: AcWGNoZ6TUQQh7NqSS+tV/eFaqqSiwAAHNhAACunLEAACTCz4A== From: "Alexander Clemm (alex)" To: "Sharon Chisholm" , X-OriginalArrivalTime: 12 Jul 2005 17:56:43.0507 (UTC) FILETIME=[10235C30:01C5870B] Cc: X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org Status: RO X-Status: X-Keywords: X-UID: 22 Sharon, and all, I am fine with the compromise and do hope that it will be incorporated. The important thing is that all the mappings are reversible and unique and take the semantics much better into account than the original mapping. The exception to the reversibility concerns the "indeterminate" one but this should be acceptable and is in a way fitting as it is, well, undeterminate. =20 Regards --- Alex -----Original Message----- From: syslog-sec-bounces@willers.employees.org [mailto:syslog-sec-bounces@willers.employees.org] On Behalf Of Sharon Chisholm Sent: Tuesday, July 12, 2005 6:34 AM To: syslog-sec@employees.org Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? hi Version -13 of the draft reflects the original severity mapping, but in the email I sent on June 29th, I proposed a compromise between this and the proposed changes by Alex. Do we have agreement to make this changes? Sharon=20 -----Original Message----- From: syslog-sec-bounces@willers.employees.org [mailto:syslog-sec-bounces@willers.employees.org] On Behalf Of Rainer Gerhards Sent: Monday, July 11, 2005 12:39 PM To: syslog-sec@employees.org Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? I think if there is no comment to the thing I posted this morning, there is probably no other issue... Rainer=20 > -----Original Message----- > From: syslog-sec-bounces@www.employees.org > [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of Chris=20 > Lonvick > Sent: Monday, July 11, 2005 6:35 PM > To: syslog-sec@employees.org > Subject: [Syslog-sec] Agenda Items for a meeting in Paris? >=20 > Hi Folks, >=20 > Are there agenda items for a meeting in Paris? > Please get them in quickly and let's see if we want to hold a meeting. >=20 > Many thanks, > Chris > _______________________________________________ > Syslog-sec mailing list > Syslog-sec@www.employees.org > http://www.employees.org/mailman/listinfo/syslog-sec >=20 _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:06 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 98CD819046 for ; Mon, 22 Aug 2005 18:52:06 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:06 -0500 (CDT) Received: from xbh-sjc-221.amer.cisco.com ([128.107.191.63]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 12 Jul 2005 11:01:16 -0700 Received: from ind-iport-1.cisco.com ([64.104.129.195]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 12 Jul 2005 11:01:15 -0700 Received: from india-core-1.cisco.com (64.104.129.221) by ind-iport-1.cisco.com with ESMTP; 12 Jul 2005 23:43:15 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,283,1115017200"; d="scan'208"; a="44087483:sNHT40146312" Received: from sj-inbound-e.cisco.com (sj-inbound-e.cisco.com [128.107.243.14]) by india-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6CI0rbA008106; Tue, 12 Jul 2005 18:01:00 GMT Received: from willers.employees.org (192.83.249.36) by sj-inbound-e.cisco.com with ESMTP; 12 Jul 2005 11:00:52 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,283,1115017200"; d="scan'208"; a="94895680:sNHT21618848" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 37DB35C755; Tue, 12 Jul 2005 11:00:36 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-3.cisco.com (sj-iport-3-in.cisco.com [171.71.176.72]) by willers.employees.org (Postfix) with ESMTP id 1B1A15C7F0 for ; Tue, 12 Jul 2005 11:00:24 -0700 (PDT) Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-3.cisco.com with ESMTP; 12 Jul 2005 11:00:24 -0700 X-IronPort-AV: i="3.93,283,1115017200"; d="scan'208"; a="302696588:sNHT38191796" Received: from xbh-sjc-231.amer.cisco.com (xbh-sjc-231.cisco.com [128.107.191.100]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j6CI0Jod016038; Tue, 12 Jul 2005 11:00:19 -0700 (PDT) Received: from xmb-sjc-236.amer.cisco.com ([128.107.191.121]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 12 Jul 2005 11:00:17 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? Date: Tue, 12 Jul 2005 11:00:16 -0700 Message-ID: <85B2F271FDF6B949B3672BA5A7BB62FB5AE021@xmb-sjc-236.amer.cisco.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Syslog-sec] Agenda Items for a meeting in Paris? Thread-Index: AcWGNoZ6TUQQh7NqSS+tV/eFaqqSiwAAHNhAACunLEAACTCz4AAAQNVg From: "Alexander Clemm (alex)" To: "Sharon Chisholm" , X-OriginalArrivalTime: 12 Jul 2005 18:00:17.0250 (UTC) FILETIME=[8F89F420:01C5870B] Cc: X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.243.14 Status: RO X-Status: X-Keywords: X-UID: 23 I just noticed it's been incorporated into -14, and in table format. Thanks. =20 --- Alex=20 -----Original Message----- From: syslog-sec-bounces@willers.employees.org [mailto:syslog-sec-bounces@willers.employees.org] On Behalf Of Alexander Clemm (alex) Sent: Tuesday, July 12, 2005 10:57 AM To: Sharon Chisholm; syslog-sec@employees.org Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? Sharon, and all, I am fine with the compromise and do hope that it will be incorporated. The important thing is that all the mappings are reversible and unique and take the semantics much better into account than the original mapping. The exception to the reversibility concerns the "indeterminate" one but this should be acceptable and is in a way fitting as it is, well, undeterminate. =20 Regards --- Alex -----Original Message----- From: syslog-sec-bounces@willers.employees.org [mailto:syslog-sec-bounces@willers.employees.org] On Behalf Of Sharon Chisholm Sent: Tuesday, July 12, 2005 6:34 AM To: syslog-sec@employees.org Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? hi Version -13 of the draft reflects the original severity mapping, but in the email I sent on June 29th, I proposed a compromise between this and the proposed changes by Alex. Do we have agreement to make this changes? Sharon=20 -----Original Message----- From: syslog-sec-bounces@willers.employees.org [mailto:syslog-sec-bounces@willers.employees.org] On Behalf Of Rainer Gerhards Sent: Monday, July 11, 2005 12:39 PM To: syslog-sec@employees.org Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? I think if there is no comment to the thing I posted this morning, there is probably no other issue... Rainer=20 > -----Original Message----- > From: syslog-sec-bounces@www.employees.org > [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of Chris=20 > Lonvick > Sent: Monday, July 11, 2005 6:35 PM > To: syslog-sec@employees.org > Subject: [Syslog-sec] Agenda Items for a meeting in Paris? >=20 > Hi Folks, >=20 > Are there agenda items for a meeting in Paris? > Please get them in quickly and let's see if we want to hold a meeting. >=20 > Many thanks, > Chris > _______________________________________________ > Syslog-sec mailing list > Syslog-sec@www.employees.org > http://www.employees.org/mailman/listinfo/syslog-sec >=20 _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:07 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 7A13619046 for ; Mon, 22 Aug 2005 18:52:07 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:07 -0500 (CDT) Received: from xbh-sjc-221.amer.cisco.com ([128.107.191.63]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 14 Jul 2005 11:08:38 -0700 Received: from rtp-iport-2.cisco.com ([64.102.122.149]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 14 Jul 2005 11:08:37 -0700 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-2.cisco.com with ESMTP; 14 Jul 2005 14:08:28 -0400 X-IronPort-AV: i="3.93,290,1115006400"; d="scan'208"; a="62348663:sNHT51512322" Received: from sj-inbound-d.cisco.com (sj-inbound-d.cisco.com [128.107.243.13]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j6EI8BkG023936; Thu, 14 Jul 2005 14:08:27 -0400 (EDT) Received: from willers.employees.org (192.83.249.36) by sj-inbound-d.cisco.com with ESMTP; 14 Jul 2005 11:08:10 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,290,1115017200"; d="scan'208"; a="92009278:sNHT16991406" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id 797A35C867; Thu, 14 Jul 2005 11:08:07 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-3.cisco.com (sj-iport-3-in.cisco.com [171.71.176.72]) by willers.employees.org (Postfix) with ESMTP id B8C0A5C814 for ; Thu, 14 Jul 2005 10:25:24 -0700 (PDT) Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-3.cisco.com with ESMTP; 14 Jul 2005 10:25:05 -0700 X-IronPort-AV: i="3.93,290,1115017200"; d="scan'208"; a="306330934:sNHT1523365798" Received: from sjc-xdm1.cisco.com (sjc-xdm1.cisco.com [171.71.162.58]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j6EHP0oe025943; Thu, 14 Jul 2005 10:25:00 -0700 (PDT) Date: Thu, 14 Jul 2005 10:25:04 -0700 (PDT) From: Chris Lonvick To: Sharon Chisholm Subject: RE: [Syslog-sec] Agenda Items for a meeting in Paris? In-Reply-To: <713043CE8B8E1348AF3C546DBE02C1B40412ADC9@zcarhxm2.corp.nortel.com> Message-ID: References: <713043CE8B8E1348AF3C546DBE02C1B40412ADC9@zcarhxm2.corp.nortel.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Mailman-Approved-At: Thu, 14 Jul 2005 11:08:05 -0700 Cc: syslog-sec@employees.org X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-OriginalArrivalTime: 14 Jul 2005 18:08:37.0566 (UTC) FILETIME=[0E939DE0:01C5889F] Status: RO X-Status: X-Keywords: X-UID: 24 Hi Folks, I'd like to thank Sharon for volunteering but I don't think that we have items to discuss for syslog-protocol and syslog-transport-udp at the Paris meeting. Let's focus on getting those to the IESG. We'll next focus on syslog-sign and 3195bis. Thanks, Chris _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From list-owner-incoming-ietf-announce@rtp-core-2.cisco.com Mon Aug 22 18:52:09 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 5CF3719046 for ; Mon, 22 Aug 2005 18:52:09 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:09 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 15 Jul 2005 14:07:31 -0700 Received: from rtp-iport-1.cisco.com ([64.102.122.148]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 15 Jul 2005 14:07:31 -0700 Received: from rtp-core-2.cisco.com (64.102.124.13) by rtp-iport-1.cisco.com with ESMTP; 15 Jul 2005 14:07:26 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,293,1115017200"; d="txt'208?scan'208,208"; a="2083678:sNHT61418196" Received: from sj-inbound-e.cisco.com (sj-inbound-e.cisco.com [128.107.243.14]) by rtp-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j6FL7IVx011920; Fri, 15 Jul 2005 17:07:19 -0400 (EDT) Received: from megatron.ietf.org (132.151.6.71) by sj-inbound-e.cisco.com with ESMTP; 15 Jul 2005 14:06:45 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,293,1115017200"; d="txt'208?scan'208,208"; a="96110125:sNHT42087888" Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DtWDk-0006M5-UE; Fri, 15 Jul 2005 15:51:40 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DtWCK-0005t9-Qc for i-d-announce@megatron.ietf.org; Fri, 15 Jul 2005 15:50:13 -0400 Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA10947 for ; Fri, 15 Jul 2005 15:50:09 -0400 (EDT) Received: from [132.151.6.50] (helo=newodin.ietf.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1DtWf3-0007pK-LO for i-d-announce@ietf.org; Fri, 15 Jul 2005 16:19:57 -0400 Received: from mlee by newodin.ietf.org with local (Exim 4.43) id 1DtWCA-0001ta-9w; Fri, 15 Jul 2005 15:50:02 -0400 Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Message-Id: Date: Fri, 15 Jul 2005 15:50:02 -0400 X-Spam-Score: 0.4 (/) X-Scan-Signature: c3a18ef96977fc9bcc21a621cbf1174b Cc: syslog-sec@employees.org Subject: I-D ACTION:draft-ietf-syslog-transport-udp-05.txt X-BeenThere: i-d-announce@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: internet-drafts@ietf.org List-Id: i-d-announce.ietf.org List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: i-d-announce-bounces@ietf.org Errors-To: i-d-announce-bounces@ietf.org X-OriginalArrivalTime: 15 Jul 2005 21:07:31.0490 (UTC) FILETIME=[36E83020:01C58981] Status: RO X-Status: X-Keywords: X-UID: 25 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Security Issues in Network Event Logging Working Group of the IETF. Title : Transmission of syslog messages over UDP Author(s) : A. Okmianski Filename : draft-ietf-syslog-transport-udp-05.txt Pages : 10 Date : 2005-7-15 This document describes the transport for syslog messages over UDP/ IPv4 or UDP/IPv6. The syslog protocol layered architecture provides for support of any number of transport mappings. However, for interoperability purposes, syslog protocol implementors are required to support this transport protocol. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-syslog-transport-udp-05.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-syslog-transport-udp-05.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-syslog-transport-udp-05.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2005-7-15131918.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-syslog-transport-udp-05.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-syslog-transport-udp-05.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2005-7-15131918.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ I-D-Announce mailing list I-D-Announce@ietf.org https://www1.ietf.org/mailman/listinfo/i-d-announce --NextPart-- From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:10 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id C51EB19046 for ; Mon, 22 Aug 2005 18:52:09 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:09 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 15 Jul 2005 18:35:41 -0700 Received: from sj-iport-3.cisco.com ([171.71.176.72]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 15 Jul 2005 18:35:41 -0700 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-3.cisco.com with ESMTP; 15 Jul 2005 18:35:39 -0700 X-IronPort-AV: i="3.93,294,1115017200"; d="scan'208"; a="308803326:sNHT169346296" Received: from sj-inbound-c.cisco.com (sj-inbound-c.cisco.com [128.107.234.206]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j6G1ZOok019939; Fri, 15 Jul 2005 18:35:39 -0700 (PDT) Received: from willers.employees.org (192.83.249.36) by sj-inbound-c.cisco.com with ESMTP; 15 Jul 2005 18:35:39 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.93,294,1115017200"; d="scan'208"; a="81460182:sNHT21703276" Received: from willers.employees.org (localhost.employees.org [127.0.0.1]) by willers.employees.org (Postfix) with ESMTP id B52605C74E; Fri, 15 Jul 2005 18:35:34 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from newodin.ietf.org (unknown [132.151.6.50]) by willers.employees.org (Postfix) with ESMTP id 3678F5C83E for ; Fri, 15 Jul 2005 12:50:02 -0700 (PDT) Received: from mlee by newodin.ietf.org with local (Exim 4.43) id 1DtWCA-0001ta-9w; Fri, 15 Jul 2005 15:50:02 -0400 Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Message-Id: Date: Fri, 15 Jul 2005 15:50:02 -0400 X-Mailman-Approved-At: Fri, 15 Jul 2005 18:35:33 -0700 X-Content-Filtered-By: Mailman/MimeDel 2.1.4 Cc: syslog-sec@employees.org Subject: [Syslog-sec] I-D ACTION:draft-ietf-syslog-transport-udp-05.txt X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-OriginalArrivalTime: 16 Jul 2005 01:35:41.0003 (UTC) FILETIME=[AD0109B0:01C589A6] Status: RO X-Status: X-Keywords: X-UID: 26 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Security Issues in Network Event Logging Working Group of the IETF. Title : Transmission of syslog messages over UDP Author(s) : A. Okmianski Filename : draft-ietf-syslog-transport-udp-05.txt Pages : 10 Date : 2005-7-15 This document describes the transport for syslog messages over UDP/ IPv4 or UDP/IPv6. The syslog protocol layered architecture provides for support of any number of transport mappings. However, for interoperability purposes, syslog protocol implementors are required to support this transport protocol. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-syslog-transport-udp-05.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-syslog-transport-udp-05.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-syslog-transport-udp-05.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec --NextPart-- From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:13 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 4B76219046 for ; Mon, 22 Aug 2005 18:52:13 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:13 -0500 (CDT) Received: from xbh-sjc-231.amer.cisco.com ([128.107.191.100]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Sun, 7 Aug 2005 15:03:00 -0700 Received: from rtp-iport-2.cisco.com ([64.102.122.149]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Sun, 7 Aug 2005 15:03:02 -0700 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-2.cisco.com with ESMTP; 07 Aug 2005 18:03:03 -0400 X-IronPort-AV: i="3.95,173,1120449600"; d="scan'208"; a="65562508:sNHT59535430" Received: from sj-inbound-d.cisco.com (sj-inbound-d.cisco.com [128.107.243.13]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j77M2dTA014429; Sun, 7 Aug 2005 18:02:46 -0400 (EDT) Received: from willers.employees.org (192.83.249.36) by sj-inbound-d.cisco.com with ESMTP; 07 Aug 2005 15:02:44 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.95,173,1120460400"; d="scan'208"; a="99808243:sNHT17096612" Received: from willers.employees.org (localhost.employees.org [IPv6:::1]) by willers.employees.org (Postfix) with ESMTP id B95A25C764; Sun, 7 Aug 2005 15:02:39 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-3.cisco.com (sj-iport-3-in.cisco.com [171.71.176.72]) by willers.employees.org (Postfix) with ESMTP id 181225C72A for ; Sun, 7 Aug 2005 14:02:39 -0700 (PDT) Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-3.cisco.com with ESMTP; 07 Aug 2005 14:02:38 -0700 X-IronPort-AV: i="3.95,173,1120460400"; d="scan'208"; a="329946239:sNHT30829124" Received: from sjc-cde-003.cisco.com (sjc-cde-003.cisco.com [171.71.162.81]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j77L2a0K028482; Sun, 7 Aug 2005 14:02:37 -0700 (PDT) Date: Sun, 7 Aug 2005 14:02:36 -0700 (PDT) From: Chris Lonvick To: housley@vigilsec.com, hartmans-ietf@mit.edu Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Mailman-Approved-At: Sun, 07 Aug 2005 14:08:24 -0700 Cc: syslog-sec@employees.org Subject: [Syslog-sec] Request for publication of draft-ietf-syslog-protocol-14.txt X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.243.13 X-OriginalArrivalTime: 07 Aug 2005 22:03:02.0139 (UTC) FILETIME=[C7A124B0:01C59B9B] Status: RO X-Status: X-Keywords: X-UID: 30 Security ADs, Having passed a WG Last Call, draft-ietf-syslog-protocol-14.txt is ready for AD review. [Area] SECURITY [WG] syslog [I-D] draft-ietf-syslog-protocol-14.txt [Qver] draft-ietf-proto-wgchair-doc-shepherding-05.txt [Shep] Chris Lonvick The WG last call turned up no additional comments or discussion. 1.a) Have the chairs personally reviewed this version of the Internet Draft (ID), and in particular, do they believe this ID is ready to forward to the IESG for publication? Yes. 1.b) Has the document had adequate review from both key WG members and key non-WG members? Do you have any concerns about the depth or breadth of the reviews that have been performed? Adequate review has occurred from WG members, and it has been reviewed by others. I am satisfied about the level of review. 1.c) Do you have concerns that the document needs more review from a particular (broader) perspective (e.g., security, operational complexity, someone familiar with AAA, etc.)? No. 1.d) Do you have any specific concerns/issues with this document that you believe the ADs and/or IESG should be aware of? For example, perhaps you are uncomfortable with certain parts of the document, or have concerns whether there really is a need for it. In any event, if your issues have been discussed in the WG and the WG has indicated it that it still wishes to advance the document, detail those concerns in the write-up. No. 1.e) How solid is the WG consensus behind this document? Does it represent the strong concurrence of a few individuals, with others being silent, or does the WG as a whole understand and agree with it? There is strong consensus to publish this document. 1.f) Has anyone threatened an appeal or otherwise indicated extreme discontent? If so, please summarise the areas of conflict in separate email to the Responsible Area Director. No. 1.g) Have the chairs verified that the document adheres to all of the ID nits? (see http://www.ietf.org/ID-Checklist.html). Section 9.1 and 9.2 state that the IANA must "maintain" a registry. This needs to be changed to state that the IANA is requested to "create" a registry for the described values. The author can make this minor change when working with the RFC Editor. 1.h) Is the document split into normative and informative references? Are there normative references to IDs, where the IDs are not also ready for advancement or are otherwise in an unclear state? (note here that the RFC editor will not publish an RFC with normative references to IDs, it will delay publication until all such IDs are also ready for publication as RFCs.) The references are split into normative and informational references. The document is dependent upon draft-ietf-syslog-transport-udp-05.txt but that is being submitted along with this document. 1.ijk) Write-up section: * Technical Summary This document describes the syslog protocol, which is used to convey event notification messages. This protocol utilizes a layered architecture, which allows the use of any number of transport protocols for transmission of syslog messages. It also provides a message format that allows vendor-specific extensions to be provided in a structured way. * Working Group Summary The consensus of the working group was to publish this as a standards-track document. * Protocol Quality It is possible that there are implementations of this document in various stages of completion at this time. Some equipment vendors have indicated interest in supporting this document, and some non-commercial implementations are also expected. === _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:13 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id B643E19046 for ; Mon, 22 Aug 2005 18:52:13 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:13 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Sun, 7 Aug 2005 15:04:47 -0700 Received: from sj-iport-2.cisco.com ([171.71.176.71]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Sun, 7 Aug 2005 15:04:33 -0700 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-2.cisco.com with ESMTP; 07 Aug 2005 15:04:47 -0700 Received: from sj-inbound-a.cisco.com (sj-inbound-a.cisco.com [128.107.234.204]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j77M4HQX020607; Sun, 7 Aug 2005 15:04:37 -0700 (PDT) Received: from willers.employees.org (192.83.249.36) by sj-inbound-a.cisco.com with ESMTP; 07 Aug 2005 15:04:42 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.95,173,1120460400"; d="scan'208"; a="157692433:sNHT17211416" Received: from willers.employees.org (localhost.employees.org [IPv6:::1]) by willers.employees.org (Postfix) with ESMTP id C33565C79C; Sun, 7 Aug 2005 15:04:40 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-3.cisco.com (sj-iport-3-in.cisco.com [171.71.176.72]) by willers.employees.org (Postfix) with ESMTP id 196275C75A for ; Sun, 7 Aug 2005 14:02:52 -0700 (PDT) Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-3.cisco.com with ESMTP; 07 Aug 2005 14:02:52 -0700 X-IronPort-AV: i="3.95,173,1120460400"; d="scan'208"; a="329946260:sNHT30044796" Received: from sjc-cde-003.cisco.com (sjc-cde-003.cisco.com [171.71.162.81]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j77L2nop016474; Sun, 7 Aug 2005 14:02:50 -0700 (PDT) Date: Sun, 7 Aug 2005 14:02:49 -0700 (PDT) From: Chris Lonvick To: housley@vigilsec.com, hartmans-ietf@mit.edu Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Mailman-Approved-At: Sun, 07 Aug 2005 14:08:24 -0700 Cc: syslog-sec@employees.org Subject: [Syslog-sec] Request for publication of draft-ietf-syslog-transport-udp-05.txt X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.234.204 X-OriginalArrivalTime: 07 Aug 2005 22:04:33.0273 (UTC) FILETIME=[FDF31690:01C59B9B] Status: RO X-Status: X-Keywords: X-UID: 31 Security ADs, Having passed a WG Last Call, draft-ietf-syslog-transport-udp-05.txt is ready for AD review. [Area] SECURITY [WG] syslog [I-D] draft-ietf-syslog-transport-udp-05.txt [Qver] draft-ietf-proto-wgchair-doc-shepherding-05.txt [Shep] Chris Lonvick The WG last call turned up no additional comments or discussion. 1.a) Have the chairs personally reviewed this version of the Internet Draft (ID), and in particular, do they believe this ID is ready to forward to the IESG for publication? Yes. 1.b) Has the document had adequate review from both key WG members and key non-WG members? Do you have any concerns about the depth or breadth of the reviews that have been performed? Adequate review has occurred from WG members, and it has been reviewed by others. I am satisfied about the level of review. 1.c) Do you have concerns that the document needs more review from a particular (broader) perspective (e.g., security, operational complexity, someone familiar with AAA, etc.)? No. 1.d) Do you have any specific concerns/issues with this document that you believe the ADs and/or IESG should be aware of? For example, perhaps you are uncomfortable with certain parts of the document, or have concerns whether there really is a need for it. In any event, if your issues have been discussed in the WG and the WG has indicated it that it still wishes to advance the document, detail those concerns in the write-up. No. 1.e) How solid is the WG consensus behind this document? Does it represent the strong concurrence of a few individuals, with others being silent, or does the WG as a whole understand and agree with it? There is strong consensus to publish this document. 1.f) Has anyone threatened an appeal or otherwise indicated extreme discontent? If so, please summarise the areas of conflict in separate email to the Responsible Area Director. No. 1.g) Have the chairs verified that the document adheres to all of the ID nits? (see http://www.ietf.org/ID-Checklist.html). Yes. 1.h) Is the document split into normative and informative references? Are there normative references to IDs, where the IDs are not also ready for advancement or are otherwise in an unclear state? (note here that the RFC editor will not publish an RFC with normative references to IDs, it will delay publication until all such IDs are also ready for publication as RFCs.) The references are split into normative and informational references. The document is dependant upon draft-ietf-syslog-protocol-14.txt but that is being submitted along with this document. 1.ijk) Write-up section: * Technical Summary This document describes the transport for syslog messages over UDP/ IPv4 or UDP/IPv6. The syslog protocol layered architecture provides for support of any number of transport mappings. However, for interoperability purposes, syslog protocol implementors are required to support this transport protocol. * Working Group Summary The consensus of the working group was to publish this as a standards-track document. * Protocol Quality It is possible that there are implementations of this document in various stages of completion at this time. Some equipment vendors have indicated interest in supporting this document, and some non-commercial implementations are also expected. === _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:16 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id E0F4119046 for ; Mon, 22 Aug 2005 18:52:15 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:15 -0500 (CDT) Received: from xbh-sjc-221.amer.cisco.com ([128.107.191.63]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 10 Aug 2005 09:27:38 -0700 Received: from sj-iport-5.cisco.com ([171.68.10.87]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 10 Aug 2005 09:27:37 -0700 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-5.cisco.com with ESMTP; 10 Aug 2005 09:27:39 -0700 X-IronPort-AV: i="3.96,97,1122879600"; d="scan'208"; a="203983648:sNHT56171072" Received: from sj-inbound-d.cisco.com (sj-inbound-d.cisco.com [128.107.243.13]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j7AGQlZO017957; Wed, 10 Aug 2005 09:27:32 -0700 (PDT) Received: from willers.employees.org (192.83.249.36) by sj-inbound-d.cisco.com with ESMTP; 10 Aug 2005 09:27:27 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.96,97,1122879600"; d="scan'208"; a="100706050:sNHT21354436" Received: from willers.employees.org (localhost.employees.org [IPv6:::1]) by willers.employees.org (Postfix) with ESMTP id 0D3155C7F7; Wed, 10 Aug 2005 09:27:23 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from sj-iport-2.cisco.com (sj-iport-2-in.cisco.com [171.71.176.71]) by willers.employees.org (Postfix) with ESMTP id 508375C831 for ; Wed, 10 Aug 2005 09:23:39 -0700 (PDT) Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-2.cisco.com with ESMTP; 10 Aug 2005 09:23:39 -0700 Received: from sjc-cde-003.cisco.com (sjc-cde-003.cisco.com [171.71.162.81]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j7AGNbop013722 for ; Wed, 10 Aug 2005 09:23:37 -0700 (PDT) Date: Wed, 10 Aug 2005 09:23:37 -0700 (PDT) From: Chris Lonvick To: syslog-sec@employees.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Mailman-Approved-At: Wed, 10 Aug 2005 09:27:21 -0700 Cc: Subject: [Syslog-sec] 3195bis - anyone doing COOKED? X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.243.13 X-OriginalArrivalTime: 10 Aug 2005 16:27:37.0901 (UTC) FILETIME=[6BE35DD0:01C59DC8] Status: RO X-Status: X-Keywords: X-UID: 32 Hi Folks, I've asked Marshall Rose and Darren New to update RFC 3195 with respect to syslog-protocol. There are some implementations of RAW but I need to ask if anyone either has an implementation of COOKED, or is planning on doing an implementation of COOKED? If so, then your comments on the document will be greatly appreciated. If not, we should consider removing it from the document. (Note on the RFC process: An RFC that has a REQUIRED feature that no one is implementing will not have an easy time moving from a Draft Standard to a Proposed Standard. It would then be very difficult for it to become a Full Standard. If no one is going to do COOKED we should remove it from the document so that implementations can claim compliance with the full specification.) Thanks, Chris _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec From glen.f.marshall@siemens.com Mon Aug 22 18:52:16 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 7C07519046 for ; Mon, 22 Aug 2005 18:52:16 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:16 -0500 (CDT) Received: from xbh-sjc-211.amer.cisco.com ([171.70.151.144]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 10 Aug 2005 09:46:47 -0700 Received: from ind-iport-1.cisco.com ([64.104.129.195]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 10 Aug 2005 09:47:54 -0700 Received: from india-core-1.cisco.com (64.104.129.221) by ind-iport-1.cisco.com with ESMTP; 10 Aug 2005 22:21:36 -0700 Received: from sj-inbound-b.cisco.com (sj-inbound-b.cisco.com [128.107.234.205]) by india-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j7AGiibh016065 for ; Wed, 10 Aug 2005 16:46:31 GMT Received: from ns.shs.siemens.com (HELO mlvv9n2x.shs.siemens.com) (64.46.248.225) by sj-inbound-b.cisco.com with ESMTP; 10 Aug 2005 09:46:22 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.96,97,1122879600"; d="scan'208"; a="90565603:sNHT19844388" Received: from mlvv9n2x.shs.siemens.com (localhost.localdomain [127.0.0.1]) by localhost.shs.siemens.com (Postfix) with ESMTP id AE87944140 for ; Wed, 10 Aug 2005 12:46:21 -0400 (EDT) Received: from mlvv9n1x.shs.siemens.com (unknown [165.226.204.25]) by mlvv9n2x.shs.siemens.com (Postfix) with ESMTP id 8D6A244162 for ; Wed, 10 Aug 2005 12:46:21 -0400 (EDT) Received: from MLVV9MBA.ww005.siemens.net (mlvv9mba.smshsc.net [165.226.204.44]) by mlvv9n1x.shs.siemens.com (8.12.11/8.12.11) with ESMTP id j7AGkLDh005172 for ; Wed, 10 Aug 2005 12:46:21 -0400 Received: from MLVV099a.ww005.siemens.net ([165.226.248.184]) by 165.226.204.44 with InterScan Messaging Security Suite; Wed, 10 Aug 2005 12:45:05 -0400 Received: by mlvv099a.ww005.siemens.net with Internet Mail Service (5.5.2657.72) id ; Wed, 10 Aug 2005 12:46:19 -0400 Message-ID: From: Marshall Glen To: "'Chris Lonvick'" Cc: syslog-sec@employees.org Subject: RE: [Syslog-sec] 3195bis - anyone doing COOKED? Date: Wed, 10 Aug 2005 12:46:12 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.234.205 X-OriginalArrivalTime: 10 Aug 2005 16:47:54.0551 (UTC) FILETIME=[41116C70:01C59DCB] Status: RO X-Status: X-Keywords: X-UID: 33 Chris, The IHE implementation specification for RFC 3881 specifies COOKED. See http://www.ihe.net/Technical_Framework/upload/IHE_ITI_Node_Authentication_Se curity_2004_08-15.pdf It has been implemented already. Glen Marshall -----Original Message----- From: Chris Lonvick [mailto:clonvick@cisco.com] Sent: Wednesday, August 10, 2005 12:24 PM To: syslog-sec@employees.org Subject: [Syslog-sec] 3195bis - anyone doing COOKED? Hi Folks, I've asked Marshall Rose and Darren New to update RFC 3195 with respect to syslog-protocol. There are some implementations of RAW but I need to ask if anyone either has an implementation of COOKED, or is planning on doing an implementation of COOKED? If so, then your comments on the document will be greatly appreciated. If not, we should consider removing it from the document. (Note on the RFC process: An RFC that has a REQUIRED feature that no one is implementing will not have an easy time moving from a Draft Standard to a Proposed Standard. It would then be very difficult for it to become a Full Standard. If no one is going to do COOKED we should remove it from the document so that implementations can claim compliance with the full specification.) Thanks, Chris _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec ------------------------------------------------------------------------------- This message and any included attachments are from Siemens Medical Solutions USA, Inc. and are intended only for the addressee(s). The information contained herein may include trade secrets or privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you received this message in error, or have reason to believe you are not authorized to receive it, please promptly delete this message and notify the sender by e-mail with a copy to Central.SecurityOffice@shs.siemens.com Thank you From syslog-sec-bounces@willers.employees.org Mon Aug 22 18:52:17 2005 Return-Path: X-Original-To: lonvick@localhost Delivered-To: lonvick@localhost.linux.local Received: from localhost (localhost [127.0.0.1]) by linux.local (Postfix) with ESMTP id 0514719046 for ; Mon, 22 Aug 2005 18:52:17 -0500 (CDT) Received: from email.cisco.com [171.70.151.132] by localhost with IMAP (fetchmail-6.2.3) for lonvick@localhost (single-drop); Mon, 22 Aug 2005 18:52:17 -0500 (CDT) Received: from xbh-sjc-231.amer.cisco.com ([128.107.191.100]) by xmb-sjc-227.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 10 Aug 2005 09:57:32 -0700 Received: from ind-iport-1.cisco.com ([64.104.129.195]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 10 Aug 2005 09:57:32 -0700 Received: from india-core-1.cisco.com (64.104.129.221) by ind-iport-1.cisco.com with ESMTP; 10 Aug 2005 22:32:09 -0700 Received: from sj-inbound-a.cisco.com (sj-inbound-a.cisco.com [128.107.234.204]) by india-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j7AGtdbc017943; Wed, 10 Aug 2005 16:56:57 GMT Received: from willers.employees.org (192.83.249.36) by sj-inbound-a.cisco.com with ESMTP; 10 Aug 2005 09:57:04 -0700 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.96,97,1122879600"; d="scan'208"; a="159417270:sNHT16268204" Received: from willers.employees.org (localhost.employees.org [IPv6:::1]) by willers.employees.org (Postfix) with ESMTP id 8F5CE5C7CE; Wed, 10 Aug 2005 09:57:02 -0700 (PDT) X-Original-To: syslog-sec@employees.org Delivered-To: syslog-sec@employees.org Received: from ipx10102.ipxserver.de (mailin.adiscon.com [80.190.240.92]) by willers.employees.org (Postfix) with ESMTP id 87E145C7A2 for ; Wed, 10 Aug 2005 09:57:00 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by ipx10102.ipxserver.de (Postfix) with ESMTP id E08D71B00ED for ; Wed, 10 Aug 2005 18:57:06 +0200 (CEST) Received: from ipx10102.ipxserver.de ([127.0.0.1]) by localhost (ipx10102 [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 31729-08 for ; Wed, 10 Aug 2005 18:56:47 +0200 (CEST) Received: from fmint2.intern.adiscon.com (pd95b68d5.dip0.t-ipconnect.de [217.91.104.213]) by ipx10102.ipxserver.de (Postfix) with ESMTP id 3664A1B0075 for ; Wed, 10 Aug 2005 18:56:47 +0200 (CEST) Received: from grfint2.intern.adiscon.com ([172.19.0.6]) by fmint2.intern.adiscon.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 10 Aug 2005 18:56:37 +0200 Subject: RE: [Syslog-sec] 3195bis - anyone doing COOKED? Date: Wed, 10 Aug 2005 18:56:35 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Message-ID: <577465F99B41C842AAFBE9ED71E70ABA0E3880@grfint2.intern.adiscon.com> X-MS-Has-Attach: Content-class: urn:content-classes:message X-MS-TNEF-Correlator: X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Thread-Topic: [Syslog-sec] 3195bis - anyone doing COOKED? Thread-Index: AcWdyHw6fWgoOrfQQqOx+AsFJSxrBwAA5/Ow From: "Rainer Gerhards" To: X-OriginalArrivalTime: 10 Aug 2005 16:56:38.0007 (UTC) FILETIME=[79127870:01C59DCC] X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at adiscon.com Cc: X-BeenThere: syslog-sec@www.employees.org X-Mailman-Version: 2.1.4 Precedence: list List-Id: "Mailing list for the syslog Working Group in the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: syslog-sec-bounces@willers.employees.org Errors-To: syslog-sec-bounces@willers.employees.org X-PMX-Version: 4.7.1.128075 X-from-outside-Cisco: 128.107.234.204 Status: RO X-Status: X-Keywords: X-UID: 34 Chris, I have at least a partial implementation in liblogging (http://www.liblogging.org). I think its currently in the CVS version only (lack of demand), but I am in the process of moving it into the main branch. Once done, our intension is to include COOKED into our windows based apps and probably in our linux syslogd-replacement (rsyslog - www.rsyslog.com), too. The hardest part of COOKED is the relay procesing, I think there could be some room for additional compliance levels. I'll try to prepare a larger message, but I thought I provide some quick facts. I need to leave the office now and will not be in tomorrow. Rainer > -----Original Message----- > From: syslog-sec-bounces@www.employees.org=20 > [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of=20 > Chris Lonvick > Sent: Wednesday, August 10, 2005 6:24 PM > To: syslog-sec@employees.org > Subject: [Syslog-sec] 3195bis - anyone doing COOKED? >=20 > Hi Folks, >=20 > I've asked Marshall Rose and Darren New to update RFC 3195=20 > with respect to > syslog-protocol. There are some implementations of RAW but I=20 > need to ask > if anyone either has an implementation of COOKED, or is=20 > planning on doing > an implementation of COOKED? If so, then your comments on=20 > the document > will be greatly appreciated. If not, we should consider=20 > removing it from > the document. >=20 > (Note on the RFC process: An RFC that has a REQUIRED feature=20 > that no one > is implementing will not have an easy time moving from a=20 > Draft Standard to > a Proposed Standard. It would then be very difficult for it=20 > to become a > Full Standard. If no one is going to do COOKED we should=20 > remove it from > the document so that implementations can claim compliance=20 > with the full > specification.) >=20 > Thanks, > Chris > _______________________________________________ > Syslog-sec mailing list > Syslog-sec@www.employees.org > http://www.employees.org/mailman/listinfo/syslog-sec >=20 _______________________________________________ Syslog-sec mailing list Syslog-sec@www.employees.org http://www.employees.org/mailman/listinfo/syslog-sec