Re: [BEHAVE] four data models: SYSLOG, IPFIX, SNMP, RADIUS

Imho, every protocol is destined to cover specific needs.

For auditing reasons (which is my primary concern curtently) i would prefer to use RADIUS 
(or DIAMETER or anything AAA related), as long as the frequency of acct records remains 
within limits. Passing information to subscriber sessions could also be done through 
RADIUS push.
SYSLOG is good for fast one way communication and maybe it could be used for alerting.
SNMP (notifications) could also be used for alerting, but its usage for on-demand or 
historical detailed statistics gatherings should be preferred.
IPFIX could be used for near realtime logging and of course for statistics.

Generally i agree with your concerns, but instead of "choosing" only one protocol, i would 
prefer to have the scope of each protocol clearly/strictly defined, so depending on my 
needs i knew what to deploy.
For me, it would be an ugly joke if i had to deploy SNMP or IPFIX in order to have the 
historical correlation of username & IP-related stuff.

--
Tassos

Dan Wing wrote on 16/7/2012 20:55:
> As an individual, I have been worried about the possibility of disparate
> data models for NATs.  We currently have four ways to report information
> about a NAT or other address-sharing device,
>
> SYSLOG, http://tools.ietf.org/html/draft-zhou-behave-syslog-nat-logging-00
> IPFIX, http://tools.ietf.org/html/draft-sivakumar-behave-nat-logging-05
> SNMP, http://tools.ietf.org/html/draft-perreault-sunset4-cgn-mib
> RADIUS,
> http://tools.ietf.org/html/draft-cheng-behave-cgn-cfg-radius-ext-03#section-
> 4.2
>
> My concern is that operators may find it necessary to deploy all four
> protocols (IPFIX, SYSLOG, SNMP, and RADIUS) to get their needed logging and.
> This seems undesirable.  Imagine, for example, that only one of those
> protocols supported pseudo-random port assignment but only one other
> protocol provided alarms for when a subscriber consumed all their ports (and
> thus might open a support case with the operator that "the Internet is
> down").
>
> Are my concerns misplaced?
>
> -d
>
>
> _______________________________________________
> Behave mailing list
> Behave@ietf.org
> https://www.ietf.org/mailman/listinfo/behave
>