Subject: [OPSAWG] SYSLOG control MIB? (was Interest in a YANG module to manage SYSLOG?)

From: Tom Taylor <[email-masked]>
Date: Mon, 07 Apr 2014 08:58:00 -0400

My proposal for a Yang module for SYSLOG control (at the end of this 
message) drew no replies. Would people at least be interested in an SNMP 
MIB that allowed monitoring of the controls? What I have in mind is two 
tables, a basic SYSLOG control table and a rate-limited event report 
table. The contents of the tables would be as follows. The field names 
are taken from RFC 5424.

Basic SYSLOG Control Table:
--------------------------

Key: combination of APP-NAME (general class of logs) and MSGID (specific 
event type).

Assigned PRI value

Index into rate-limited table, or nil if not rate-limited

Suppressed (TRUE/FALSE)

If an event type is suppressed, the associated events are totally 
ignored by the log system, so the assigned PRI value is not meaningful 
and rate-limit value should be nil.

Rate Limited Log Control Table:
------------------------------

Key: table index

APP-NAME

MSGID

Reporting interval time units: seconds, hours, days, busy period.

Reporting interval value: integer

Maximum reports per reporting interval: integer

Count of observed events

Count of reported events

Comments?

Tom Taylor

Message previously sent (28 March)
==================================

While working on draft-ietf-behave-syslog-nat-logging, I noted a number 
of management requirements for SYSLOG that are really independent of the 
particular application being logged. These include, for example, a list 
of events for which the operator wants logging suppressed, or 
specifications for rate-limiting specific event reports. For more 
details see Section 6, particularly sub-section 6.1.3 of the draft cited 
above.

Would there be any interest in implementing or deploying a YANG module 
to provide the necessary controls if I created one?

Tom Taylor

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 7 Apr 2014 15:27:18 +0200

Tom,

I believe the problem here is that syslog configurations tend to be
rather implementation specific and finding a common core will be a
non-trivial exercise. Sure, some of the complexity is on relays and
collectors that filter / store / fowards syslog messages based on a
number of rules, so probably there is a more well scoped problem for
implementations that essentially are only syslog originators.

There was some MIB work [1] in the syslog working group but as far as
I can tell this work did not get much traction - only some common type
definitions have been published as RFC 5427.

/js

[1] http://tools.ietf.org/html/draft-ietf-syslog-device-mib-17

On Mon, Apr 07, 2014 at 08:58:00AM -0400, Tom Taylor wrote:
> message) drew no replies. Would people at least be interested in an
> SNMP MIB that allowed monitoring of the controls? What I have in
> mind is two tables, a basic SYSLOG control table and a rate-limited
> event report table. The contents of the tables would be as follows.
> The field names are taken from RFC 5424.
> 
> Key: combination of APP-NAME (general class of logs) and MSGID
> (specific event type).
> 
> Assigned PRI value
> 
> ignored by the log system, so the assigned PRI value is not
> meaningful and rate-limit value should be nil.
> 
> While working on draft-ietf-behave-syslog-nat-logging, I noted a
> number of management requirements for SYSLOG that are really
> independent of the particular application being logged. These
> include, for example, a list of events for which the operator wants
> logging suppressed, or specifications for rate-limiting specific
> event reports. For more details see Section 6, particularly
> sub-section 6.1.3 of the draft cited above.
> 
> Would there be any interest in implementing or deploying a YANG
> module to provide the necessary controls if I created one?
> 
> Tom Taylor
> 
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Tom Taylor <[email-masked]>
Date: Mon, 07 Apr 2014 10:14:38 -0400

We can see if any operators endorse this as a set of requirements. I did 
look at RFC 5427 once upon a time and was rather disappointed.

Tom

>> Basic SYSLOG Control Table:
...

---

From: t.petch <[email-masked]>
Date: Mon, 7 Apr 2014 15:29:56 +0100

----- Original Message -----
From: "Juergen Schoenwaelder" <[email-masked]>
To: "Tom Taylor" <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, April 07, 2014 2:27 PM

Tom

The syslog WG was chartered to produce a MIB module and that stayed in
the charter until 2008 but then got dropped - as Juergen says, there was
not much enthusiasm for it.  The WG was closed in 2010.

Tom Petch

---

From: Michael MacFaden <[email-masked]>
Date: Mon, 7 Apr 2014 10:52:07 -0700 (PDT)

Hi Tom,

I asked this question back in April 2012 on this list and as well and 
went as far as contacting the draft authors. Here is Glenn's reply:

I'd certainly be interested in seeing a standardized monitoring mib module
as its being used in industry. The use of syslog and volume of traffic apps 
are now sending over this protocol I believe is growing. I see syslog
often used instead of or in conjunction with SNMP.

> From: Glenn M. Keeni <glenn at cysols.com>
> Date: April, 11, 2012
> Subject: what happened to syslog-mib?
> Hi Mike, 
> Thanks for the mail.
> If you are going to implement the MIB, I would say it is a good candidate.
> It has some nice design features which may be helpful. There
> are not-nice parts too.
> Feel free to let me know if I can be of any help.

>Cheers,
>Glenn

From: Michael MacFaden <mrm at vmware.com>
Date: April 10, 2012
>Hi Mr Keeni,
>
>I was just looking to implement syslog-mib and its apparent
>you put alot of work into http://tools.ietf.org/id/draft-ietf-syslog-device-mib-17.txt

>Mike MacFaden

Cheers,
Mike

---

From: t.petch <[email-masked]>
Date: Tue, 8 Apr 2014 10:01:30 +0100

----- Original Message -----
From: "Michael MacFaden" <[email-masked]>
To: <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, April 07, 2014 6:52 PM
> often used instead of or in conjunction with SNMP.

Indeed, if there was one name I would associate with the syslog MIB
module it would be Glenn's but there were not many more.  I have long
supported SNMP and so tend to notice, and get involved with, MIB modules
just because they are MIB modules, even when they are not something I am
likely to encounter in anger.  Hence my comments on this list on
draft-hmac-sha-2-usm-snmp
but whereas I would expect that to advance to an RFC, I am less sanguine
about the propects for a syslog MIB module -  it lacks a hook to today's
hot buttons such as security, yang etc.

Incidentally, I notice that Tom has a gmail address and I read on the
main IETF list that Yahoo has, in effect, unwittingly launched a DoS
attack on mailing lists that could also impact gmail users, so I hope
that we are still communicating.

Tom Petch

> >you put alot of work into
http://tools.ietf.org/id/draft-ietf-syslog-device-mib-17.txt

---

From: Tom Taylor <[email-masked]>
Date: Tue, 08 Apr 2014 19:50:42 -0400

I'm still here and following the conversation with interest, but I've 
had preoccupations for the last day. I was unexpectedly admitted to 
hospital this morning (transplanted immune system is rejecting me once 
again) and it took a while to get my laptop from home and get it set up.

I'll read the old drafts you referred to. Maybe among us we amount to 
sufficient critical mass.

Tom Taylor

...
...