Subject: RE: [Syslog] Revised proposed charter

From: "Alexander Clemm \(alex\)" <[email-masked]>
Date: Wed, 23 Nov 2005 09:50:47 -0800

I think the charter looks good.  It describes what the working group has
to do and its deliverables.  I agree that there is a next level of
details that spells out the specifics of how to do it.  We had a lot of
discussion on this and seem to have come to a consensus, which is
something that we should capture.   However, the question is if that
next level (the "how" in addition to the "what") really belongs in a
charter - not sure if the charter would be the right place.  
-- Alex

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Anton Okmianski
(aokmians)
Sent: Wednesday, November 23, 2005 9:29 AM
To: Chris Lonvick (clonvick); [email-masked]
Subject: RE: [Syslog] Revised proposed charter

Chris:

This is fine, but does not include all the other specific details we
agreed on and as such is not different from what we had before. I think
we can focus our efforts better by creating narrower scope.  How about
limiting backwards compatibility to <PRI> only. Requiring
standardization of better time stamp. Support for FQDN, IPv6. MSGID.
Internationalization (UTF-8). Etc... I am afraid that if we leave the
charter open-ended as before, we will be debating the charter again 2
years from now.  

Also, sorry if I missed some earlier discussions on signing messages.
Proposed charter mentions source authentication. For TCP mappings (such
as BEEP), TLS already provides authentication and encryption.  SSH
transport would provide similar facilities. Is there an overlap here? Is
message signing targeted at just UDP transport?   

Thanks,
Anton.   

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Chris Lonvick 
> (clonvick)
> Sent: Wednesday, November 23, 2005 12:05 PM
> To: [email-masked]
> Subject: [Syslog] Revised proposed charter
> 
> Hi All,
> 
> ==== v2 of proposed charter ===
> 
> Syslog is a de-facto standard for logging system events.  
> However, the protocol component of this event logging system has not 
> been formally documented.  While the protocol has been very useful and

> scalable, it has some known security problems which were documented in

> RFC 3164.
> 
> The goal of this working group is to address the security and 
> integrity problems, and to standardize the syslog protocol, transport,

> and a select set of mechanisms in a manner that considers the ease of 
> migration between and the co-existence of existing versions and the 
> standard.
> 
> syslog has traditionally been transported over UDP and this WG has 
> already defined RFC 3195 for the reliable transport for the syslog 
> messages.  The WG will separate the UDP transport from the protocol so

> that others may define additional transports in the future.
> 
> 
> - A document will be produced that describes a standardized 
> syslog protocol.  A mechanism will also be defined in this 
> document that will provide a means to convey structured data.
> 
> - A document will be produced that describes a standardized 
> UDP transport for syslog.
> 
> - A document will be produced that describes a standardized 
> mechanism to sign syslog messages to provide integrity 
> checking and source authentication.
> 
> 
> === ===
> 
> Comments please.
> 
> Thanks,
> Chris
> 
> _______________________________________________
> Syslog mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/syslog
> 

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "Tom Petch" <[email-masked]>
Date: Fri, 25 Nov 2005 09:40:14 +0100

<inline>
Tom Petch

----- Original Message -----
From: "Alexander Clemm (alex)" <[email-masked]>
To: "Anton Okmianski (aokmians)" <[email-masked]>; "Chris Lonvick
(clonvick)" <[email-masked]>; <[email-masked]>
Sent: Wednesday, November 23, 2005 6:50 PM
Subject: RE: [Syslog] Revised proposed charter

something that we should capture.

[tp] Strange, I was thiinking quite the opposite, that we had a fragile
consensus which disappeared in
Vancouver and has not been refound.  Looking back at the messages posted in the
past few days, about what should be in the header in what order, I was thinking,
 what now? because I see no consensus, rather the re-emergence of many
different points of view.

So while the proposed charter looks ok, because it does not go into that detail,
I do not see how we progress any further, into the next level of technical
detail, of what and
how should be in the header.

<snip>

---

From: Darren Reed <[email-masked]>
Date: Sat, 26 Nov 2005 09:35:21 +1100 (EST)

[ Charset ISO-8859-1 unsupported, converting... ]
> Vancouver and has not been refound.  Looking back at the messages posted
> in the past few days, about what should be in the header in what order,
> I was thinking,
> So while the proposed charter looks ok, because it does not go into that
> detail, I do not see how we progress any further, into the next level of
> technical detail, of what and how should be in the header.

So long as everyone wants to solve every problem in one single RFC,
we will go nowhere.  For those people I say "go use 3195" and stop
bothering the group with yoru quibbles.

All this nonsense about NUL characters and message lengths, XML,
structured data, etc.  Too many people here have a pet peeve they
want to see the first draft solve and seem determined to overload
it with that so that they're covered/happy.

This is not a way forward but a way backward.

We need to evolve the syslog protocol and we need to do that starting
with the basic protocol that has been used for years, build upon that
in a structured manner and conquer one piece of the problem at a time.

If one thing is clear from this, it won't be possible to write a
single document that makes good all of the evolutions of the syslog
protocol.  Some are going to have to be put in the "bad basket."

If that happens to be yours, or mine, stiff.  We're all going to
need to make sacrifices and changes if anything useful is going
to be achieved.

Darren

---

From: "Tom Petch" <[email-masked]>
Date: Sat, 26 Nov 2005 10:29:10 +0100

----- Original Message -----
From: "Darren Reed" <[email-masked]>
To: "Tom Petch" <[email-masked]>
Cc: <[email-masked]>
Sent: Friday, November 25, 2005 11:35 PM
Subject: Re: [Syslog] Revised proposed charter

> need to make sacrifices and changes if anything useful is going

Mmmm I agree that sacrifices are needed but am puzzled by your reference to
first draft.  Syslog-protocol is at -15 and represents a (fragile) consensus
about XML, null octet, truncation etc.  What I don't understand is that
Vancouver seems to say that we must reinstate <PRI> - ok - and while we are at
it, go back to square one on lots of other things.  If that is how it is, so be
it (but I am still puzzled).

Tom Petch

---

From: Darren Reed <[email-masked]>
Date: Sat, 26 Nov 2005 22:53:34 +1100 (EST)

Why?

Because the community implementing syslog protocol things seems to be
ignoring what the group has been doing.

This may be because they're unaware of the work or because it is being
regarded as a "WTF?!" and doing their own thing.

Most people seem to be ignoring 3195.  Lets learn from that experience
and try to develop something that'll be what people want to use rather
than what we think they need.

Darren