From clonvick@cisco.com Fri Oct 1 13:12:13 2010 Return-Path: X-Original-To: syslog@core3.amsl.com Delivered-To: syslog@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1D06E3A6E06 for ; Fri, 1 Oct 2010 13:12:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.599 X-Spam-Level: X-Spam-Status: No, score=-110.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HhYUK8MaN9Th for ; Fri, 1 Oct 2010 13:12:11 -0700 (PDT) Received: from sj-iport-4.cisco.com (sj-iport-4.cisco.com [171.68.10.86]) by core3.amsl.com (Postfix) with ESMTP id E13DE3A6D01 for ; Fri, 1 Oct 2010 13:12:10 -0700 (PDT) Authentication-Results: sj-iport-4.cisco.com; dkim=neutral (message not signed) header.i=none X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AkIGAG/dpUyrR7Hu/2dsb2JhbACUMQEBjgdxrG2cRIVEBIRR X-IronPort-AV: E=Sophos;i="4.57,268,1283731200"; d="scan'208";a="194788002" Received: from sj-core-5.cisco.com ([171.71.177.238]) by sj-iport-4.cisco.com with ESMTP; 01 Oct 2010 20:12:59 +0000 Received: from sjc-cde-011.cisco.com (sjc-cde-011.cisco.com [171.69.16.68]) by sj-core-5.cisco.com (8.13.8/8.14.3) with ESMTP id o91KCxh5001906 for ; Fri, 1 Oct 2010 20:12:59 GMT Date: Fri, 1 Oct 2010 13:12:58 -0700 (PDT) From: Chris Lonvick To: syslog@ietf.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Subject: [Syslog] Update on syslog/dtls X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Oct 2010 20:12:13 -0000 Hi Folks, Just so everyone is aware, syslog/dtls is in AUTH48. One of the authors got the notification just before going on holiday so won't be able to review it for about two weeks. The others have either ok'd it or are busy reviewing it right now. ..I'm certain. Thanks, Chris From clonvick@cisco.com Fri Oct 1 13:15:16 2010 Return-Path: X-Original-To: syslog@core3.amsl.com Delivered-To: syslog@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7C96C3A6C88 for ; Fri, 1 Oct 2010 13:15:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.599 X-Spam-Level: X-Spam-Status: No, score=-110.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yRTiXampdFFK for ; Fri, 1 Oct 2010 13:15:14 -0700 (PDT) Received: from sj-iport-3.cisco.com (sj-iport-3.cisco.com [171.71.176.72]) by core3.amsl.com (Postfix) with ESMTP id 943713A6E0F for ; Fri, 1 Oct 2010 13:15:14 -0700 (PDT) Authentication-Results: sj-iport-3.cisco.com; dkim=neutral (message not signed) header.i=none X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AkIGAJvepUyrR7Ht/2dsb2JhbACUMAEBjgdxrGKcRIVEBIRR X-IronPort-AV: E=Sophos;i="4.57,268,1283731200"; d="scan'208";a="241114094" Received: from sj-core-1.cisco.com ([171.71.177.237]) by sj-iport-3.cisco.com with ESMTP; 01 Oct 2010 20:16:03 +0000 Received: from sjc-cde-011.cisco.com (sjc-cde-011.cisco.com [171.69.16.68]) by sj-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id o91KG3MN025785 for ; Fri, 1 Oct 2010 20:16:03 GMT Date: Fri, 1 Oct 2010 13:16:03 -0700 (PDT) From: Chris Lonvick To: syslog@ietf.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Subject: [Syslog] New Version Notification for draft-gerhards-syslog-plain-tcp-05 (fwd) X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Oct 2010 20:15:16 -0000 Hi Folks, While this is a non-WG item, there are some people interested. I've updated the syslog/tcp draft and I'll invite reviews and comments. Thanks, Chris ---------- Forwarded message ---------- Date: Thu, 30 Sep 2010 09:04:15 -0700 (PDT) From: IETF I-D Submission Tool To: clonvick@cisco.com Cc: rgerhards@adiscon.com Subject: New Version Notification for draft-gerhards-syslog-plain-tcp-05 A new version of I-D, draft-gerhards-syslog-plain-tcp-05.txt has been successfully submitted by Chris Lonvick and posted to the IETF repository. Filename: draft-gerhards-syslog-plain-tcp Revision: 05 Title: Transmission of Syslog Messages over TCP Creation_date: 2010-09-30 WG ID: Independent Submission Number_of_pages: 14 Abstract: There have been many implementations and deployments of legacy syslog over TCP for many years. That protocol has evolved without being standardized and has proven to be quite interoperable in practice. The aim of this specification is to document three things: how to transmit standardized syslog over TCP, how TCP has been used as a transport for legacy syslog, and how to correlate these usages. The IETF Secretariat. From wwwrun@rfc-editor.org Thu Oct 14 10:12:13 2010 Return-Path: X-Original-To: syslog@core3.amsl.com Delivered-To: syslog@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AA1EC3A68C0; Thu, 14 Oct 2010 10:12:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.046 X-Spam-Level: X-Spam-Status: No, score=-102.046 tagged_above=-999 required=5 tests=[AWL=-0.046, BAYES_00=-2.599, J_CHICKENPOX_93=0.6, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sZ1GcQJX2YpZ; Thu, 14 Oct 2010 10:12:12 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [IPv6:2001:1890:1112:1::2f]) by core3.amsl.com (Postfix) with ESMTP id 5FEA13A699F; Thu, 14 Oct 2010 10:12:12 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id D5079E06E5; Thu, 14 Oct 2010 10:13:31 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org From: rfc-editor@rfc-editor.org Message-Id: <20101014171331.D5079E06E5@rfc-editor.org> Date: Thu, 14 Oct 2010 10:13:31 -0700 (PDT) Cc: syslog@ietf.org, rfc-editor@rfc-editor.org Subject: [Syslog] RFC 6012 on Datagram Transport Layer Security (DTLS) Transport Mapping for Syslog X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Oct 2010 17:12:13 -0000 A new Request for Comments is now available in online RFC libraries. RFC 6012 Title: Datagram Transport Layer Security (DTLS) Transport Mapping for Syslog Author: J. Salowey, T. Petch, R. Gerhards, H. Feng Status: Standards Track Stream: IETF Date: October 2010 Mailbox: jsalowey@cisco.com, tomSecurity@network-engineer.co.uk, rgerhards@adiscon.com, fhyfeng@gmail.com Pages: 12 Characters: 24475 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-syslog-dtls-06.txt URL: http://www.rfc-editor.org/rfc/rfc6012.txt This document describes the transport of syslog messages over the Datagram Transport Layer Security (DTLS) protocol. It provides a secure transport for syslog messages in cases where a connectionless transport is desired. [STANDARDS-TRACK] This document is a product of the Security Issues in Network Event Logging Working Group of the IETF. This is now a Proposed Standard Protocol. STANDARDS TRACK: This document specifies an Internet standards track protocol for the Internet community,and requests discussion and suggestions for improvements. Please refer to the current edition of the Internet Official Protocol Standards (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see http://www.ietf.org/mailman/listinfo/ietf-announce http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html. For downloading RFCs, see http://www.rfc-editor.org/rfc.html. Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From clonvick@cisco.com Tue Oct 19 09:12:55 2010 Return-Path: X-Original-To: syslog@core3.amsl.com Delivered-To: syslog@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AA3DC3A6866 for ; Tue, 19 Oct 2010 09:12:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.599 X-Spam-Level: X-Spam-Status: No, score=-110.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mlDgIGmLhhGL for ; Tue, 19 Oct 2010 09:12:48 -0700 (PDT) Received: from sj-iport-4.cisco.com (sj-iport-4.cisco.com [171.68.10.86]) by core3.amsl.com (Postfix) with ESMTP id 9498E3A688C for ; Tue, 19 Oct 2010 09:12:48 -0700 (PDT) Authentication-Results: sj-iport-4.cisco.com; dkim=neutral (message not signed) header.i=none X-Files: None : None X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AmwFAONgvUyrR7H+/2dsb2JhbACTbQEBjXlxpQacWYMICII6BIRV X-IronPort-AV: E=Sophos;i="4.57,351,1283731200"; d="txt'?scan'208";a="203190536" Received: from sj-core-2.cisco.com ([171.71.177.254]) by sj-iport-4.cisco.com with ESMTP; 19 Oct 2010 16:14:19 +0000 Received: from sjc-cde-011.cisco.com (sjc-cde-011.cisco.com [171.69.16.68]) by sj-core-2.cisco.com (8.13.8/8.14.3) with ESMTP id o9JGEJQV001514 for ; Tue, 19 Oct 2010 16:14:19 GMT Date: Tue, 19 Oct 2010 09:14:19 -0700 (PDT) From: Chris Lonvick To: syslog@ietf.org Message-ID: MIME-Version: 1.0 Content-Type: MULTIPART/MIXED; boundary=NextPart Content-ID: Subject: [Syslog] I-D ACTION:draft-cloud-log-00.txt (fwd) X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Oct 2010 16:12:55 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --NextPart Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII Content-ID: Hi, I figured that people might be interested in this. Please contact the authors if you have comments. Thanks, Chris ---------- Forwarded message ---------- Date: Fri, 15 Oct 2010 14:15:01 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Subject: I-D ACTION:draft-cloud-log-00.txt A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : Syslog Extension for Cloud Using Syslog Structured Data Author(s) : G. Golovinsky, S. Johnston, Z. Fox Filename : draft-cloud-log-00.txt Pages : 9 Date : 2010-10-15 This document provides an open and extensible log format to be used by any cloud entity or cloud application to log and trace activities that occur in the cloud. It is equally applicable for cloud infrastructure (IaaS), platform (PaaS), and application (SaaS) services. CloudLog is defferent in content, but not in nature from the traditional logging as it takes in account transient nature of identities and resources in the cloud. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-cloud-log-00.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: MESSAGE/EXTERNAL-BODY; name=draft-cloud-log-00.txt; site=ftp.ietf.org; access-type=anon-ftp; directory=internet-drafts Content-ID: Content-Description: --NextPart Content-Type: TEXT/PLAIN; CHARSET=US-ASCII Content-ID: Content-Description: Content-Disposition: attachment _______________________________________________ I-D-Announce mailing list I-D-Announce@ietf.org https://www.ietf.org/mailman/listinfo/i-d-announce Internet-Draft directories: http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt --NextPart-- From gene@alertlogic.com Tue Oct 19 10:51:57 2010 Return-Path: X-Original-To: syslog@core3.amsl.com Delivered-To: syslog@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E340B3A6838 for ; Tue, 19 Oct 2010 10:51:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[AWL=0.268, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MxfqTnY-Mp3c for ; Tue, 19 Oct 2010 10:51:57 -0700 (PDT) Received: from smtp205.dfw.emailsrvr.com (smtp205.dfw.emailsrvr.com [67.192.241.205]) by core3.amsl.com (Postfix) with ESMTP id 0227A3A67AB for ; Tue, 19 Oct 2010 10:51:56 -0700 (PDT) Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp20.relay.dfw1a.emailsrvr.com (SMTP Server) with ESMTP id 1CE712584F8; Tue, 19 Oct 2010 13:53:28 -0400 (EDT) X-Virus-Scanned: OK Received: from smtp192.mex07a.mlsrvr.com (smtp192.mex07a.mlsrvr.com [67.192.133.192]) by smtp20.relay.dfw1a.emailsrvr.com (SMTP Server) with ESMTPS id 3829C2C8016; Tue, 19 Oct 2010 13:52:56 -0400 (EDT) Received: from 34093-MBX-C01.mex07a.mlsrvr.com ([192.168.1.62]) by DFW1HUB13.mex07a.mlsrvr.com ([192.168.1.209]) with mapi; Tue, 19 Oct 2010 12:52:55 -0500 From: Gene Golovinsky To: Chris Lonvick , "syslog@ietf.org" Date: Tue, 19 Oct 2010 12:52:56 -0500 Thread-Topic: [Syslog] I-D ACTION:draft-cloud-log-00.txt (fwd) Thread-Index: ActvqOaE0+GHLn+bSnysJWNDGb31fwADXwyQ Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailman-Approved-At: Wed, 20 Oct 2010 08:04:32 -0700 Subject: Re: [Syslog] I-D ACTION:draft-cloud-log-00.txt (fwd) X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Oct 2010 17:51:58 -0000 Hi. I am on this list as well and will be happy to see the discussion. --Gene -----Original Message----- From: syslog-bounces@ietf.org [mailto:syslog-bounces@ietf.org] On Behalf Of= Chris Lonvick Sent: Tuesday, October 19, 2010 11:14 AM To: syslog@ietf.org Subject: [Syslog] I-D ACTION:draft-cloud-log-00.txt (fwd) Hi, I figured that people might be interested in this. Please contact the auth= ors if you have comments. Thanks, Chris ---------- Forwarded message ---------- Date: Fri, 15 Oct 2010 14:15:01 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Subject: I-D ACTION:draft-cloud-log-00.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. Title : Syslog Extension for Cloud Using Syslog Structured Data Author(s) : G. Golovinsky, S. Johnston, Z. Fox Filename : draft-cloud-log-00.txt Pages : 9 Date : 2010-10-15 This document provides an open and extensible log format to be used by any cloud entity or cloud application to log and trace activities that occur in the cloud. It is equally applicable for cloud infrastructure (IaaS), platform (PaaS), and application (SaaS) services. CloudLog is defferent in content, but not in nature from the traditional logging as it takes in account transient nature of identities and resources in the cloud. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-cloud-log-00.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementa= tion to automatically retrieve the ASCII version of the Internet-Draft. From wwwrun@core3.amsl.com Tue Oct 26 10:30:25 2010 Return-Path: X-Original-To: syslog@ietf.org Delivered-To: syslog@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 30) id AA8F03A69A9; Tue, 26 Oct 2010 10:30:24 -0700 (PDT) From: IESG Secretary To: IETF Announcement list Content-Type: text/plain; charset="utf-8" Mime-Version: 1.0 Message-Id: <20101026173024.AA8F03A69A9@core3.amsl.com> Date: Tue, 26 Oct 2010 10:30:24 -0700 (PDT) Cc: syslog@ietf.org Subject: [Syslog] WG Action: Conclusion of Security Issues in Network Event Logging (syslog) X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Oct 2010 17:30:25 -0000 The Security Issues in Network Event Logging (syslog) working group in the Security Area has concluded. The IESG contact persons are Tim Polk and Sean Turner. The syslog working group has completed its charter items, and is officially closing. The mailing list will be retained for future discussions involving syslog. The syslog working group was primarily focused on standardizing the syslog protocol for logging system events. Initially developed on the University of California Berkeley Software Distribution (BSD) TCP/IP system implementations, syslog became the defacto standard. The SYSLOG working group standardized the protocol within the IETF. In total the working group published eight RFCs, including The Syslog Protocol (RFC 5424), Transmission of Syslog Messages over UDP (RFC 5426), Transport Layer Security (TLS) Transport Mapping for Syslog (RFC 5245), and Datagram Transport Layer Security (DTLS) Transport Mapping for Syslog (RFC 6012). I would like to thank all of the IETF participants who have contributed to the various documents produced by the syslog working group and to the successful completion of these important deliverables. We especially thank Chris Lonvick and David Harrington who have chaired the working group from its inception. I would also like to recognize Eric Allman, who is the original inventor and author of the syslog daemon and protocol. The syslog mailing list will remain open and the list archive will be retained. - Sean Turner From clonvick@cisco.com Wed Oct 27 06:05:37 2010 Return-Path: X-Original-To: syslog@core3.amsl.com Delivered-To: syslog@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D1C5F3A694A for ; Wed, 27 Oct 2010 06:05:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.599 X-Spam-Level: X-Spam-Status: No, score=-110.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a7QLmGjRdf6b for ; Wed, 27 Oct 2010 06:05:37 -0700 (PDT) Received: from sj-iport-4.cisco.com (sj-iport-4.cisco.com [171.68.10.86]) by core3.amsl.com (Postfix) with ESMTP id 0A2733A686D for ; Wed, 27 Oct 2010 06:05:37 -0700 (PDT) Authentication-Results: sj-iport-4.cisco.com; dkim=neutral (message not signed) header.i=none X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av0EAJbAx0yrRN+J/2dsb2JhbACTXgGNeXGgQpwShUgEhFc X-IronPort-AV: E=Sophos;i="4.58,246,1286150400"; d="scan'208";a="207554089" Received: from sj-core-3.cisco.com ([171.68.223.137]) by sj-iport-4.cisco.com with ESMTP; 27 Oct 2010 13:07:26 +0000 Received: from sjc-cde-011.cisco.com (sjc-cde-011.cisco.com [171.69.16.68]) by sj-core-3.cisco.com (8.13.8/8.14.3) with ESMTP id o9RD7Q1V003731 for ; Wed, 27 Oct 2010 13:07:26 GMT Date: Wed, 27 Oct 2010 06:07:26 -0700 (PDT) From: Chris Lonvick To: syslog@ietf.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Subject: [Syslog] Conclusion of the syslog WG - THANK YOU! X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Oct 2010 13:05:38 -0000 Hi Folks, I totally missed Sean's message from yesterday (can't even find it in the deleted bin). http://www.ietf.org/mail-archive/web/syslog/current/msg02634.html With that, I'd like to thank everyone who has participated in this Working Group throughout the years. Your participation has helped create a set of documents that standardizes the transport and security of log messages. While we went through a few rough spots, overall, I think that the effort has paid off. All of the authors of the documents have been outstanding and I thank you for your effort and patience. I would also like to recognize the IESG members and especially our Advisors: Jeff Schiller, Marcus Leach, Steve Bellovin, Sam Hartman, Pasi Eronen, and Sean Turner. And a final thank you to David Harrington who picked up a lot of the effort as my co-chair for some of the more interesting years. The mailing list will remain active and we can use it to discuss implementations and related work. Thanks, Chris From rgerhards@hq.adiscon.com Wed Oct 27 06:08:19 2010 Return-Path: X-Original-To: syslog@core3.amsl.com Delivered-To: syslog@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B8C833A69E2 for ; Wed, 27 Oct 2010 06:08:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LYngKZTsCbrg for ; Wed, 27 Oct 2010 06:08:18 -0700 (PDT) Received: from vmmail.adiscon.com (vmmail.adiscon.com [178.63.79.189]) by core3.amsl.com (Postfix) with ESMTP id A0B9C3A686D for ; Wed, 27 Oct 2010 06:08:17 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by vmmail.adiscon.com (Postfix) with ESMTP id DA2B074A48F; Wed, 27 Oct 2010 13:25:09 +0200 (CEST) Received: from vmmail.adiscon.com ([127.0.0.1]) by localhost (vmmail.adiscon.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2kB3bbnrOskL; Wed, 27 Oct 2010 13:25:09 +0200 (CEST) Received: from GRFEXC.intern.adiscon.com (pd95c774a.dip0.t-ipconnect.de [217.92.119.74]) by vmmail.adiscon.com (Postfix) with ESMTPA id AA44B74A48E; Wed, 27 Oct 2010 13:25:09 +0200 (CEST) Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft Exchange V6.5 Date: Wed, 27 Oct 2010 15:10:05 +0200 Message-ID: <9B6E2A8877C38245BFB15CC491A11DA71DD5CB@GRFEXC.intern.adiscon.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [Syslog] Conclusion of the syslog WG - THANK YOU! Thread-Index: Act11+CrobS0fL2NQOGjARo8MRtvQgAACCeA References: From: "Rainer Gerhards" To: "Chris Lonvick" , Subject: Re: [Syslog] Conclusion of the syslog WG - THANK YOU! X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Oct 2010 13:08:19 -0000 Hi Folks and Chris, and I would like to express my sincere thanks to the long-term chair and driving force behind this effort! And, of course, to all those people = Chris already mentioned. I really agree with Chris that this was productive work, especially as = we begin to see major player pick up the standards. Thanks to all! Rainer=20 > -----Original Message----- > From: syslog-bounces@ietf.org [mailto:syslog-bounces@ietf.org] On > Behalf Of Chris Lonvick > Sent: Wednesday, October 27, 2010 3:07 PM > To: syslog@ietf.org > Subject: [Syslog] Conclusion of the syslog WG - THANK YOU! >=20 > Hi Folks, >=20 > I totally missed Sean's message from yesterday (can't even find it in > the > deleted bin). > http://www.ietf.org/mail-archive/web/syslog/current/msg02634.html >=20 > With that, I'd like to thank everyone who has participated in this > Working > Group throughout the years. Your participation has helped create a = set > of > documents that standardizes the transport and security of log = messages. > While we went through a few rough spots, overall, I think that the > effort > has paid off. >=20 > All of the authors of the documents have been outstanding and I thank > you > for your effort and patience. >=20 > I would also like to recognize the IESG members and especially our > Advisors: Jeff Schiller, Marcus Leach, Steve Bellovin, Sam Hartman, > Pasi > Eronen, and Sean Turner. >=20 > And a final thank you to David Harrington who picked up a lot of the > effort as my co-chair for some of the more interesting years. >=20 >=20 > The mailing list will remain active and we can use it to discuss > implementations and related work. >=20 > Thanks, > Chris > _______________________________________________ > Syslog mailing list > Syslog@ietf.org > https://www.ietf.org/mailman/listinfo/syslog From clonvick@cisco.com Wed Oct 27 06:13:23 2010 Return-Path: X-Original-To: syslog@core3.amsl.com Delivered-To: syslog@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9F3753A6A50 for ; Wed, 27 Oct 2010 06:13:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.599 X-Spam-Level: X-Spam-Status: No, score=-110.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VW7LT7Kx5avG for ; Wed, 27 Oct 2010 06:13:13 -0700 (PDT) Received: from sj-iport-2.cisco.com (sj-iport-2.cisco.com [171.71.176.71]) by core3.amsl.com (Postfix) with ESMTP id EB4C93A6A33 for ; Wed, 27 Oct 2010 06:10:14 -0700 (PDT) Authentication-Results: sj-iport-2.cisco.com; dkim=neutral (message not signed) header.i=none X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av0EADzCx0yrR7H+/2dsb2JhbACTXwGNeXGgTZwShUgEhFc X-IronPort-AV: E=Sophos;i="4.58,246,1286150400"; d="scan'208";a="287312987" Received: from sj-core-2.cisco.com ([171.71.177.254]) by sj-iport-2.cisco.com with ESMTP; 27 Oct 2010 13:12:03 +0000 Received: from sjc-cde-011.cisco.com (sjc-cde-011.cisco.com [171.69.16.68]) by sj-core-2.cisco.com (8.13.8/8.14.3) with ESMTP id o9RDC3rm004770 for ; Wed, 27 Oct 2010 13:12:03 GMT Date: Wed, 27 Oct 2010 06:12:03 -0700 (PDT) From: Chris Lonvick To: syslog@ietf.org Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Subject: [Syslog] Publication of RFC 6012 X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Oct 2010 13:13:23 -0000 Hi Folks, I've also not received notification of the publication of syslog/dtls. Nonetheless, here it is: http://tools.ietf.org/html/rfc6012 I'd like to thank Joe for his editorial skills and perseverence, as well as Tom, Rainer, and Hongyan for merging their original proposals into a workable document. Also, thanks to the people on the list who reviewed the document and sent in their comments - that's what makes the IETF work. Thanks, Chris From jon@callas.org Wed Oct 27 09:33:37 2010 Return-Path: X-Original-To: syslog@core3.amsl.com Delivered-To: syslog@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 97A533A680C for ; Wed, 27 Oct 2010 09:33:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z7hgWQOcZL8k for ; Wed, 27 Oct 2010 09:33:23 -0700 (PDT) Received: from merrymeet.com (merrymeet.com [66.93.68.160]) by core3.amsl.com (Postfix) with ESMTP id D69B43A6A2A for ; Wed, 27 Oct 2010 09:33:08 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by merrymeet.com (Postfix) with ESMTP id C037D2E00D for ; Wed, 27 Oct 2010 09:35:09 -0700 (PDT) Received: from merrymeet.com ([127.0.0.1]) by localhost (host.domain.tld [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 91919-01 for ; Wed, 27 Oct 2010 09:35:05 -0700 (PDT) Received: from keys.merrymeet.com (keys.merrymeet.com [66.93.68.161]) (Authenticated sender: jon) by merrymeet.com (Postfix) with ESMTPA id BD6AE2E034 for ; Wed, 27 Oct 2010 09:35:05 -0700 (PDT) Received: from [10.0.23.13] ([66.93.68.163]) by keys.merrymeet.com (PGP Universal service); Wed, 27 Oct 2010 09:34:07 -0700 X-PGP-Universal: processed; by keys.merrymeet.com on Wed, 27 Oct 2010 09:34:07 -0700 From: Jon Callas Date: Wed, 27 Oct 2010 09:34:53 -0700 Message-Id: To: syslog@ietf.org Mime-Version: 1.0 (Apple Message framework v1081) X-Mailer: Apple Mail (2.1081) X-PGP-Encoding-Format: Partitioned X-PGP-Encoding-Version: 2.0.2 X-Content-PGP-Universal-Saved-Content-Transfer-Encoding: 7bit X-Content-PGP-Universal-Saved-Content-Type: text/plain; charset=us-ascii Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7BIT X-Virus-Scanned: Maia Mailguard Subject: [Syslog] Congrats to everyone X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Oct 2010 16:33:38 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 on a job well done! Jon -----BEGIN PGP SIGNATURE----- Version: PGP Universal 2.10.0 (Build 554) Charset: us-ascii wj8DBQFMyFR/sTedWZOD3gYRAk48AKDuqgnxzdinIanCM2n8NWDGQyaP1ACg2jQ1 nuHjZ9ZyGCTyqeNVkRHLifk= =MRX/ -----END PGP SIGNATURE----- From tglassey@earthlink.net Wed Oct 27 10:40:57 2010 Return-Path: X-Original-To: syslog@core3.amsl.com Delivered-To: syslog@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 75E523A68B1 for ; Wed, 27 Oct 2010 10:40:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 05pV-J1ZhaND for ; Wed, 27 Oct 2010 10:40:56 -0700 (PDT) Received: from elasmtp-scoter.atl.sa.earthlink.net (elasmtp-scoter.atl.sa.earthlink.net [209.86.89.67]) by core3.amsl.com (Postfix) with ESMTP id 69FC93A6888 for ; Wed, 27 Oct 2010 10:40:56 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=earthlink.net; b=TFYqhR2ZVYCc9QZj+t7oNwwnZsqF3eU+VpShaBpFhvSE5D5n6qJJmUl+/a/R2e2q; h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:References:In-Reply-To:Content-Type:Content-Transfer-Encoding:X-ELNK-Trace:X-Originating-IP; Received: from [207.111.209.5] (helo=[192.168.1.101]) by elasmtp-scoter.atl.sa.earthlink.net with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.67) (envelope-from ) id 1PBA1O-00015V-2a for syslog@ietf.org; Wed, 27 Oct 2010 13:42:46 -0400 Message-ID: <4CC8649C.4090106@earthlink.net> Date: Wed, 27 Oct 2010 10:42:52 -0700 From: todd glassey User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.11) Gecko/20101013 Lightning/1.0b2 Thunderbird/3.1.5 MIME-Version: 1.0 To: syslog@ietf.org References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-ELNK-Trace: 01b7a7e171bdf5911aa676d7e74259b7b3291a7d08dfec796c0665242e0b1597e99230b1c9d3c5f4350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 207.111.209.5 Subject: Re: [Syslog] Conclusion of the syslog WG - THANK YOU! X-BeenThere: syslog@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Issues in Network Event Logging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Oct 2010 17:40:57 -0000 On 10/27/2010 6:07 AM, Chris Lonvick wrote: > Hi Folks, > > I totally missed Sean's message from yesterday (can't even find it in > the deleted bin). > http://www.ietf.org/mail-archive/web/syslog/current/msg02634.html > > With that, I'd like to thank everyone who has participated in this > Working Group throughout the years. Your participation has helped create > a set of documents that standardizes the transport and security of log > messages. While we went through a few rough spots, overall, I think that > the effort has paid off. > > All of the authors of the documents have been outstanding and I thank > you for your effort and patience. > > I would also like to recognize the IESG members and especially our > Advisors: Jeff Schiller, Marcus Leach, Steve Bellovin, Sam Hartman, Pasi > Eronen, and Sean Turner. > > And a final thank you to David Harrington who picked up a lot of the > effort as my co-chair for some of the more interesting years. > > > The mailing list will remain active and we can use it to discuss > implementations and related work. > > Thanks, > Chris Chris - how does this all figure into the legal issues created by the California court order in California v Khaled, since it is this information which will be used a evidence of criminal actions. Seems to me that closing SYSLOG down not is not such a good idea but hey... it wouldn't be the first time the IETF did something out of whack. Todd Glassey > _______________________________________________ > Syslog mailing list > Syslog@ietf.org > https://www.ietf.org/mailman/listinfo/syslog > -- //----------------------------------------------------------------- This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation.