Re: [BEHAVE] logging drafts

I propose the following:

(1) Record exactly the same events and parameters in SYSLOG as in IPFIX. 
I have arguments for why this is reasonable.

(2) Add a Deployment Considerations section that provides a context for 
the use of the fields that have been defined. As an example, it would 
cover what logging would include for different transition methods. As 
another example, it might explore different architectures in which log 
collection would happen. As a sub-case of the latter, some events in 
some situations happen at provisioning time and are reasonably collected 
or reported by AAA.

Comments?

Tom Taylor

On 13/03/2013 2:11 PM, Dan Wing wrote:
> The two NAT logging drafts were presented at the BEHAVE meeting at IETF86 (draft-sivakumar-behave-nat-logging-06 and draft-ietf-behave-syslog-nat-logging-00).  They are both WG documents and based on the feedback at the meeting, we would like to see:
>
>   * an update of the table presented at the meeting (slide 6 of http://tools.ietf.org/agenda/86/slides/slides-86-behave-2.pdf).
>   * text added to the SYSLOG and IPFIX documents explaining their applicability.
>   * discussion on the list to reach consensus that SYSLOG and IPFIX should, or should not, send different events because of their different applicability.
>
> -d
>
> _______________________________________________
> Behave mailing list
> Behave@ietf.org
> https://www.ietf.org/mailman/listinfo/behave
>