Subject: [Syslog] Consensus on Charter?

From: "Rainer Gerhards" <[email-masked]>
Date: Tue, 29 Nov 2005 18:13:42 +0100

Chris, WG:

as you are probably aware, Sam's deadline for comments about the future
of this WG is quickly approaching (it is December, 1st). I plan to
formally update my comment.  To do so, I would like to know if we have
reached consensus on the charter.

I have taken the liberty to merge some changes discussed on-list into v2
of Chris' charter proposal.

Is this the charter we are looking for? I would appreciate quick
feedback because I have to write my mail to Sam tomorrow.

Rainer

==== MODIFIED Version of Chris's v2 of proposed charter ===

Syslog is a de-facto standard for logging system events.  However, the 
protocol component of this event logging system has not been formally 
documented.  While the protocol has been very useful and scalable, it
has 
some known security problems which were documented in RFC 3164.

The goal of this working group is to address the security and integrity 
problems, and to standardize the syslog protocol, transport, and a
select 
set of mechanisms in a manner that considers the ease of migration
between 
and the co-existence of existing versions and the standard.

syslog has traditionally been transported over UDP and this WG has
already 
defined RFC 3195 for the reliable transport for the syslog messages.
The 
WG will separate the UDP transport from the protocol so that others may 
define additional transports in the future.

- A document will be produced that describes a standardized syslog
protocol.  A mechanism will also be defined in this document
that will provide a means to convey structured data. While compatability
with existing syslog systems is desirable, research shows
that these are so diverse that there is nothing in common amongst them
apart
from <PRI> so that whilst that field will be retained, other fields may
not be.

- A document will be produced that describes a standardized UDP
transport for syslog.

- A document will be produced that describes a standardized mechanism
to sign syslog messages to provide integrity checking and source
authentication.

- A MIB definition for syslog will be produced.
=== ===

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Chris Lonvick <[email-masked]>
Date: Tue, 29 Nov 2005 09:41:09 -0800 (PST)

Hi Rainer,

I've already sent my comments to Sam including the v2 of the charter.  I'm 
still waiting on feedback from him.  The proposed charter below looks 
good.

Please do send your comments to him.  As he said, it's good to send them 
to the WG list as well.

Thanks,
Chris

---

From: Darren Reed <[email-masked]>
Date: Wed, 30 Nov 2005 05:45:57 +1100 (EST)

Are we happy to recharter when these are done to cover TCP ?

Darren