[netmod] Comments on syslog data model

["Alexander Clemm (alex)" <[e-mail]>]

Hi Clyde,

as mentioned on yesterday's call, I would suggest addressing RFC 5848 in YANG model (http://tools.ietf.org/html/draft-wildes-netmod-syslog-model-02).  This is the RFC for signed syslog messages.  Since this is IETF standards track and the YANG model is to be published by IETF as well, I think this needs to be included.

Since there are many applications that do not support syslog-sign, this can be made feature-dependent.  For this purpose, a feature "syslog-sign" can be declared, and corresponding YANG items be marked with a statement "if-feature syslog-sign".  The incremental cost of implementation is thus zero when signed syslog is not supported by an implementation.

The RFC is here: http://tools.ietf.org/html/rfc5848

Please see specifically section 6.1, which defines a minimal set of parameters that should be configurable.

Here is a corresponding snippet that could be added to the model in fairly straightforward manner.

                                container syslog-sign {
                                                if-feature syslog-sign;
                                                presence
                                                                "If present, syslog-sign is activated for this receiver";
                                                leaf certInitialRepeat {
                                                                type uint16;
                                                }
                                                leaf certResendDelay {
                                                                type uint16;
                                                }
                                                leaf certResendCount {
                                                                type uint16;
                                                }
                                                leaf sigMaxDelay {
                                                                type uint16;
                                                }
                                                leaf sigNumberResends {
                                                                type uint16;
                                                }
                                                leaf sigResendDelay {
                                                                type uint16;
                                                }
                                                leaf sigResendCount {
                                                                type uint16;
                                                }


Furthermore, to allow for configuration of sessions, you also need the following:

                                                choice signature-group {
                                                                case 0 {
                                                                                leaf single-signature-group {
                                                                                                type empty;
                                                                                }
                                                                }
                                                                case 1 {
                                                                                leaf pri-per-signature-group {
                                                                                                type empty;
                                                                                }
                                                                }
                                                                case 2 {
                                                                                list pri-range-signature-group {
                                                                                                key "sg-id";
                                                                                                leaf sg-id {
                                                                                                                type uint8;
                                                                                                }
                                                                                                leaf max-spri {
                                                                                                                type uint8;
                                                                                                                range "0 .. 192";
                                                                                                }
                                                                                }
                                                                }
                                                                case 3 {
                                                                                leaf custom-signature-group-scheme {
                                                                                                type empty;
                                                                                }
                                                                }
                                                }
                                                leaf certificateBlock {
                                                                config false;
                                                                description
                                                                                "Certificate block that is in effect for this session";
                                                                type string;
                                                }
                                                leaf currentRebootSessionId {
                                                                config false;
                                                                type uint64;
                                                                range "0 .. 9999999999";
                                                }
                                                leaf currentGlobalBlockCounter {
                                                                config false;
                                                                type uint64;
                                                                range "0 .. 9999999999";
                                                }
                                }

In case you want to include monitoring, here is the following:
                                container subscription-stats {
                                                if-feature syslog-stats;
                                                config false;
                                                leaf messages-sent {
                                                                type uint32;
                                                }
                                                leaf messages-filtered {
                                                                type uint32;
                                                }
                                                leaf certBlockResends {
                                                                if-feature syslog-sign;
                                                                type uint32;
                                                }
                                                leaf sigBlocks {
                                                                if-feature syslog-sign;
                                                                type uint32;
                                                }
                                }

Thanks
--- Alex