Subject: [Syslog] Re: I-D ACTION:draft-ietf-syslog-protocol-15.txt

From: Glenn Mansfield Keeni <[email-masked]>
Date: Mon, 07 Nov 2005 16:14:29 +0900

Hi,
  A few small points that I noticed while reviewing the latest 15.txt draft
are given below. Apologies for noticing some of these so late in the day.

  Cheers

  Glenn

+=============================================================================+

Comments

a. page 7 Section 4 Basic Principles
   The significance of the second clause is not clear.
     Is it essential that senders not know whether the
     receiver is a collector or a relay?
   To me it seems that Senders MAY or MAY NOT know ...

b. page 11 Section 6.1
   the term "payload" is used only once in the document.
   It is not defined anywhere. I suggest
            s/payload/message/.

c. page 12 Section 6.2.2
   Probably there has been prior discussion on this- but,
   a sentence that indicates that the present FACILITY codes
   as in RFC 3164 are (?) reserved, would be helpful. New
   FACILITY code definitions MUST not override the RFC 3164
   FACILITY codes.

d. page 14 Section 6.2.4

          Value    Meaning
             00    There has been no truncation

   needs to be added.

e. page 15 Section 6.2.5
   The semantics of the TIMESTAMP field is not obvious.
   It would be nice to have something like
       The TIMESTAMP field gives the time at which the
       syslog message was generated at the sender.
   or. something more appropriate.

f. page 17 Section 6.2.7
   It would be nice to add that the APP-NAME is the
   sender's name.

g. page 17 Section 6.2.8
   The text says
       The PROCID field SHOULD be used to provide the
       sender's process name or process ID
   The difference between APP-NAME and PROCID is not clear.
   In the example that is given in the following paragraph
   the PROCID   could be "syslogd" or "NNNN"
   But, if PROCID is "syslogd" then the point of the example
   will not hold. We will not be able to detect restarts of
   the syslog!
   I would think that
       APP-NAME should be "syslogd" and
       PROCID   should be NNNN.

   Am I missing something ?

+-------------------------------------------------------------------------+

[email-masked] wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Security Issues in Network Event Logging Working Group of the IETF.
> 
> 	Title		: The syslog Protocol
> 	Author(s)	: R. Gerhards
> 	Filename	: draft-ietf-syslog-protocol-15.txt
> 	Pages		: 48
> 	Date		: 2005-10-21
> 	
> This document describes the syslog protocol, which is used to convey
>    event notification messages.  This protocol utilizes a layered
>    architecture, which allows the use of any number of transport
>    protocols for transmission of syslog messages.  It also provides a
>    message format that allows vendor-specific extensions to be provided
>    in a structured way.
> 
>    This document has been written with the spirit of traditional syslog
>    in mind.  The reason for a new layered specification has arisen
>    because standardization efforts for reliable, and secure syslog
>    extensions suffer from the lack of a standards-track and transport
>    independent RFC.  Without this document, each other standard needs to
>    define its own syslog packet format and transport mechanism, which
>    over time will introduce subtle compatibility issues.  This document
>    tries to provide a foundation that syslog extensions can build on.
>    The layered architecture also provides a solid basis that allows code
>    to be written once instead of multiple times, once for each syslog
>    feature.
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-15.txt
> 
> To remove yourself from the I-D Announcement list, send a message to 
> [email-masked] with the word unsubscribe in the body of the message.  
> You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
> to change your subscription settings.
> 
> 
> Internet-Drafts are also available by anonymous FTP. Login with the username
> "anonymous" and a password of your e-mail address. After logging in,
> type "cd internet-drafts" and then
> 	"get draft-ietf-syslog-protocol-15.txt".
> 
> A list of Internet-Drafts directories can be found in
> http://www.ietf.org/shadow.html 
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> 
> 
> Internet-Drafts can also be obtained by e-mail.
> 
> Send a message to:
> 	[email-masked].
> In the body type:
> 	"FILE /internet-drafts/draft-ietf-syslog-protocol-15.txt".
> 	
> NOTE:	The mail server at ietf.org can return the document in
> 	MIME-encoded form by using the "mpack" utility.  To use this
> 	feature, insert the command "ENCODING mime" before the "FILE"
> 	command.  To decode the response(s), you will need "munpack" or
> 	a MIME-compliant mail reader.  Different MIME-compliant mail readers
> 	exhibit different behavior, especially when dealing with
> 	"multipart" MIME messages (i.e. documents which have been split
> 	up into multiple messages), so check your local documentation on
> 	how to manipulate these messages.
> 		
> 		
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/i-d-announce

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog