Subject: RE: IAP/0.4 questions

From: "Eric D. Williams" <[email-masked]>
Date: Tue, 20 Feb 2001 20:38:07 -0500

Ben,

Thanks! I missed that asterisk every time :).

On Tuesday, February 20, 2001 7:22 PM, Ben Feinstein 
[SMTP:[email-masked]] wrote:
> On Tue, 20 Feb 2001, Eric D. Williams wrote:
>
> > However, I am not sure that the indication of "an IDMEF-Message element can
> >
> > contain multiple Alert elements" is true.  I do not recall, having re-read
> > the
> > draft, the IDEMF-Message Alert element allowing multiple alerts in a
> > message.
> >  In fact I think you can have one only per message.  I could be wrong or
> >  maybe
> > it is not clear to me because of the <tag/> stuff.  Anyway, containing
> > multiple
> > IDEMF-Message elements should cover it.
>
> See Section 5.2.1 of draft-ietf-idwg-idmef-xml-03.txt for a definition of
> the "IDMEF-Message Class".  The IDMEF-Message element is declared in the
> IDMEF DTD as
>
> <!ELEMENT IDMEF-Message                   (
>           (Alert | Heartbeat)*
>         )>
>
> meaning that it can contain zero of more Alerts or Heartbeats.
>
> How about this?
>
> 'An iap-content-request MAY contain zero or more IDEMF-Message elements.
> Each IDMEF element MAY contain zero or more subelements, including
> multiple Alert and Heartbeat elements. Thus, an iap-content-request
> message MAY contain more than one Alert.'
>
>
> > QUESTION: Does this introduce a problem with iap-content-request messages
> > containing multiple IDEMF-Message elements of type Alert and IDEMF-Message
> > elements of type Heartbeat commingled and introducing Manager overhead
> > issues?
>
> Typically, a Manager would be using an IAP library to receive
> iap-content-requests.  Any aggregation or sorting of the IAP message
> contents is really outside the scope of IAP.  Note that the use of an XML
> parser makes the task of aggregating and sorting IDMEF-Messages and Alerts
> relatively straightforward for a Manager using IAP.
>
>
> Cheers,
>
> Ben Feinstein
> Harvey Mudd College, Computer Science