Subject: RE: [Syslog] Revised proposed charter

From: "Rainer Gerhards" <[email-masked]>
Date: Thu, 24 Nov 2005 13:48:13 +0100

Oops, I have overlooked that one. I agree with Glenn that this should be
in the charter.

Rainer 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Glenn 
> Mansfield Keeni
> Sent: Thursday, November 24, 2005 11:33 AM
> To: [email-masked]
> Subject: Re: [Syslog] Revised proposed charter
> 
> Chris,
>      You seem to have dropped the last deliverable which is 
> in good shape
> 
> >     - A MIB definition for syslog will be produced.
> 
> I would strongly recommend that we include it. It is an 
> important aspect
> of the protocol. Some effort has gone into it. And it is the least
> controversial [there are no issues of backward compatibility]. And it
> is very close to completion.
> 
> Glenn
> 
> Chris Lonvick wrote:
> > Hi All,
> > 
> > ==== v2 of proposed charter ===
> > 
> > Syslog is a de-facto standard for logging system events.  
> However, the
> > protocol component of this event logging system has not 
> been formally
> > documented.  While the protocol has been very useful and 
> scalable, it
> > has some known security problems which were documented in RFC 3164.
> > 
> > The goal of this working group is to address the security 
> and integrity
> > problems, and to standardize the syslog protocol, transport, and a
> > select set of mechanisms in a manner that considers the ease of
> > migration between and the co-existence of existing versions and the
> > standard.
> > 
> > syslog has traditionally been transported over UDP and this WG has
> > already defined RFC 3195 for the reliable transport for the syslog
> > messages.  The WG will separate the UDP transport from the 
> protocol so
> > that others may define additional transports in the future.
> > 
> > 
> > - A document will be produced that describes a standardized syslog
> > protocol.  A mechanism will also be defined in this document
> > that will provide a means to convey structured data.
> > 
> > - A document will be produced that describes a standardized UDP
> > transport for syslog.
> > 
> > - A document will be produced that describes a standardized 
> mechanism
> > to sign syslog messages to provide integrity checking and source
> > authentication.
> > 
> > 
> > === ===
> > 
> > Comments please.
> > 
> > Thanks,
> > Chris
> > 
> > _______________________________________________
> > Syslog mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/syslog
> 
> 
> 
> 
> _______________________________________________
> Syslog mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/syslog
> 

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Chris Lonvick <[email-masked]>
Date: Thu, 24 Nov 2005 08:42:03 -0800 (PST)

Hi,

OK - sorry 'bout that.

Glenn - please update it and get it into the ID repository.

All - who will commit to reviewing this document?  I will need someone to 
commit to this before I put it into the proposed charter.

Thanks,
Chris

---

From: "Tom Petch" <[email-masked]>
Date: Fri, 25 Nov 2005 09:47:16 +0100

Chris

I was not, am not, quite clear what you are asking for but I am an SNMP expert
and do review MIBs and was planning to do so for the syslog MIB as and when the
protocol that the MIB is of is stable.  (Be warned, when I commit to do
something, I
tend to avoid committing to a date and vice versa:-)

I would expect a MIB to be required of us by IESG unless we can put up a very
strong case why not.

Tom Petch