Subject: Re: [Isms] SNMP-SSH-TM-MIB session info

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 11 Sep 2007 10:49:15 +0200

On Mon, Aug 13, 2007 at 11:50:49AM -0400, David Harrington wrote:
 
> SNMP does not have sessions; the only sessions are sessions of the
> transport protocol. This module counts sessions. We have no way of
> knowing whether, for example, SSH chooses to close a session without
> telling us. We can only count how many times we called openSession,
> and how many times we called closeSession ASIs. We do not know how
> many  sessions the SSH implementation can handle, or how many SSH
> sessions are currently open.  I think we should eliminate the
> sshtmSessionCurrent and sshtmSessionMaxSupported objects. 

I agree. But speaking as a technical contributor and implementor, I
would actually support the inclusion for counters that count the
number of times openSession() and closeSession() have been invoked
since frequent calls to open / close SSH sessions can very well be an
issue worth being able to easily detect (and sticking the counter into
the code for this is really easy).

So my proposal would be to delete sshtmSessionCurrent and
sshtmSessionMaxSupported and instead add:

sshtmSessionOpens  OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION "The number of times an openSession() request has been 
    		 executed.
                "
    ::= { sshtmSession 1 }

sshtmSessionCloses  OBJECT-TYPE
    SYNTAX       Counter32
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION "The number of times a closeSession() request has been
                 executed.
                "
    ::= { sshtmSession 2 }

Note that we have to be clear how the counters related to each other.
One option is that sshtmSessionOpens and sshtmSessionCloses count all
open and close requests, regardless whether they success of fail. The
counter sshtmSessionOpenErrors would then count all open errors while
sshtmSessionUserAuthFailures and sshtmSessionChannelOpenFailures would
then only count these specific failures. In other words,

sshtmSessionOpenErrors = sshtmSessionUserAuthFailures
		         + sshtmSessionChannelOpenFailures
                         + <other>

sshtmSessionOpens = sshtmSessionOpenErrors + <successfull opens>

The alternative is that sshtmSessionOpens only counts successful opens
and then we would have the total number of opens as the sum of
sshtmSessionOpens and sshtmSessionOpenErrors. I can go either way as
long as the relationship between the counters is clearly defined.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms