[BEHAVE] Logging: address exhaustion and port exhaustion events

[Tom Taylor <[e-mail]>]

In the -04 pass for the SYSLOG logging document, I added the following 
text in the section describing the address pool threshold events:

<begin>

The high-water-mark threshold event provides a warning that the
address-port combinations offered by the pool are nearing exhaustion.
Upon exhaustion, packets may be dropped because no address has enough
free port values left to be allocated to an address mapping ("address
exhaustion"). This applies to the case of "paired" pooling behaviour
[RFC4787], where typically an address will not be
allocated unless it has a sufficient number of free ports.
Alternatively, packets will be dropped simply because no address in the
pool has a free port number for the required protocol ("port
exhaustion").

Packets dropped due to address exhaustion are included in the amounts
provided by the following NAT MIB counters:
   o globally, natResourceErrors in the natCounters table;

   o per protocol, natProtocolResourceErrors in natProtocolTable;

   o per subscriber, natSubscriberResourceErrors in
     natSubscribersTable.>

Packets dropped due to port exhaustion are counted in the following
NAT MIB counters:
   o globally, natOutOfPortErrors in the natCounters table;
   o per protocol, natProtocolOutOfPortErrors in natProtocolTable;
   o per subscriber, natSubscriberOutOfPortErrors in
     natSubscribersTable.

<end>

First question: do people agree with the proposed definitions of address 
exhaustion and port exhaustion? If so, we have operational definitions a 
NAT can work with in generating both counts and logs.

Second question: our current OAM-related events are all based on 
administratively-set limits and thresholds. Should the address 
exhaustion and port exhaustion events also be logged?

Tom Taylor