Re: [BEHAVE] logging drafts

Dan Wing <dwing@cisco.com> Mon, 15 April 2013 20:15 UTC

Return-Path: <dwing@cisco.com>
X-Original-To: behave@ietfa.amsl.com
Delivered-To: behave@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1BB521F9437 for <behave@ietfa.amsl.com>; Mon, 15 Apr 2013 13:15:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -110.599
X-Spam-Level:
X-Spam-Status: No, score=-110.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3luBBQb9S4iL for <behave@ietfa.amsl.com>; Mon, 15 Apr 2013 13:15:53 -0700 (PDT)
Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by ietfa.amsl.com (Postfix) with ESMTP id CD73921F93E1 for <behave@ietf.org>; Mon, 15 Apr 2013 13:15:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1816; q=dns/txt; s=iport; t=1366056954; x=1367266554; h=mime-version:subject:from:in-reply-to:date:cc: content-transfer-encoding:message-id:references:to; bh=Efhv7s5UsfK12mstNvF3v7HhR+CHbhLhNt1b0UPMLqo=; b=IACFbk0BdGkpAfZR9I9W5e8zUnLy9dfTSgy10PfR7HEJyOYue/WUBT5G nj/PQ2wYEjFpxII9MyeG29x/+8TtHvyezVupjozzKJ0TIJkRy0i7EKaLR dM9bu/eEelHH5AXjqjIZISbpEpzpCEzmylSPoJaDb8YaeBl0L3wuj06FB E=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AlYFAMJebFGtJV2d/2dsb2JhbABQgwY2wQWBBxZ0gh8BAQECAQEBAQE3NAsFCwsYLiEGMAYTiAIDCQYMsXQNiV2MRIIgMweCYGEDiQWMHYFjgSGEZIVwhRyDKxw
X-IronPort-AV: E=Sophos;i="4.87,479,1363132800"; d="scan'208";a="199038084"
Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by rcdn-iport-5.cisco.com with ESMTP; 15 Apr 2013 20:15:22 +0000
Received: from [10.156.17.93] ([10.156.17.93]) by rcdn-core-6.cisco.com (8.14.5/8.14.5) with ESMTP id r3FKFJ8i022503; Mon, 15 Apr 2013 20:15:19 GMT
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\))
From: Dan Wing <dwing@cisco.com>
In-Reply-To: <5169E1BF.6000202@gmail.com>
Date: Mon, 15 Apr 2013 13:15:19 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <30323D44-D982-4090-B42F-4BB36E8D7545@cisco.com>
References: <65DAA8E7-B1A8-4581-80F2-D1734999BA1A@cisco.com> <5169E1BF.6000202@gmail.com>
To: Tom Taylor <tom.taylor.stds@gmail.com>
X-Mailer: Apple Mail (2.1503)
Cc: "behave@ietf.org" <behave@ietf.org>, behave-chairs@tools.ietf.org
Subject: Re: [BEHAVE] logging drafts
X-BeenThere: behave@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: mailing list of BEHAVE IETF WG <behave.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/behave>, <mailto:behave-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/behave>
List-Post: <mailto:behave@ietf.org>
List-Help: <mailto:behave-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/behave>, <mailto:behave-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 15 Apr 2013 20:15:54 -0000

On Apr 13, 2013, at 3:52 PM, Tom Taylor <tom.taylor.stds@gmail.com> wrote:

> I propose the following:
> 
> (1) Record exactly the same events and parameters in SYSLOG as in IPFIX. I have arguments for why this is reasonable.
> 
> (2) Add a Deployment Considerations section that provides a context for the use of the fields that have been defined. As an example, it would cover what logging would include for different transition methods. As another example, it might explore different architectures in which log collection would happen. As a sub-case of the latter, some events in some situations happen at provisioning time and are reasonably collected or reported by AAA.
> 
> Comments?

Yes, that sounds like a good approach.

-d


> Tom Taylor
> 
> On 13/03/2013 2:11 PM, Dan Wing wrote:
>> The two NAT logging drafts were presented at the BEHAVE meeting at IETF86 (draft-sivakumar-behave-nat-logging-06 and draft-ietf-behave-syslog-nat-logging-00).  They are both WG documents and based on the feedback at the meeting, we would like to see:
>> 
>>  * an update of the table presented at the meeting (slide 6 of http://tools.ietf.org/agenda/86/slides/slides-86-behave-2.pdf).
>>  * text added to the SYSLOG and IPFIX documents explaining their applicability.
>>  * discussion on the list to reach consensus that SYSLOG and IPFIX should, or should not, send different events because of their different applicability.
>> 
>> -d
>> 
>> _______________________________________________
>> Behave mailing list
>> Behave@ietf.org
>> https://www.ietf.org/mailman/listinfo/behave
>> 
> _______________________________________________
> Behave mailing list
> Behave@ietf.org
> https://www.ietf.org/mailman/listinfo/behave