Subject: Re: [OPSAWG] SYSLOG control MIB? (was Interest in a YANG module tomanage SYSLOG?)

From: t.petch <[email-masked]>
Date: Tue, 22 Jul 2014 09:57:14 +0100

Tom

I do not know if you have seen

draft-wildes-netmod-syslog-model-02.txt

or its precursors.  It is a bit thin on description and so hard to tell
just what it is modelling and it does seem to go in a different
direction to your requirements but you never know, it might be subverted
to do what you want!

Tom Petch

----- Original Message -----
From: "Tom Taylor" <[email-masked]>
To: <[email-masked]>
Sent: Monday, April 07, 2014 1:58 PM
Subject: [OPSAWG] SYSLOG control MIB? (was Interest in a YANG module
tomanage SYSLOG?)

> My proposal for a Yang module for SYSLOG control (at the end of this
> message) drew no replies. Would people at least be interested in an
SNMP
> MIB that allowed monitoring of the controls? What I have in mind is
two
> tables, a basic SYSLOG control table and a rate-limited event report
> table. The contents of the tables would be as follows. The field names
> are taken from RFC 5424.
>
> Basic SYSLOG Control Table:
> --------------------------
>
> Key: combination of APP-NAME (general class of logs) and MSGID
(specific
> event type).
>
> Assigned PRI value
>
> Index into rate-limited table, or nil if not rate-limited
>
> Suppressed (TRUE/FALSE)
>
> If an event type is suppressed, the associated events are totally
> ignored by the log system, so the assigned PRI value is not meaningful
> and rate-limit value should be nil.
>
> Rate Limited Log Control Table:
> ------------------------------
>
> Key: table index
>
> APP-NAME
>
> MSGID
>
> Reporting interval time units: seconds, hours, days, busy period.
>
> Reporting interval value: integer
>
> Maximum reports per reporting interval: integer
>
> Count of observed events
>
> Count of reported events
>
> Comments?
>
> Tom Taylor
>
>
>
> Message previously sent (28 March)
> ==================================
>
> While working on draft-ietf-behave-syslog-nat-logging, I noted a
number
> of management requirements for SYSLOG that are really independent of
the
> particular application being logged. These include, for example, a
list
> of events for which the operator wants logging suppressed, or
> specifications for rate-limiting specific event reports. For more
> details see Section 6, particularly sub-section 6.1.3 of the draft
cited
> above.
>
> Would there be any interest in implementing or deploying a YANG module
> to provide the necessary controls if I created one?
>
> Tom Taylor
>
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg

---

From: Tom Taylor <[email-masked]>
Date: Tue, 22 Jul 2014 09:55:35 -0400

Thanks, I still intend to get onto this.

Tom Taylor