Re: [netmod] Syslog YANG Model Presentation

[Chris Lonvick <[e-mail]>]

Hi,
The very brief background:
- the syslog WG was chartered under the Security Area to secure the protocol
- the BEEP work never took off so we rechartered and found that we needed
to make changes to the protocol itself
- in making the changes, Rainer Gerhards proposed structured data and the
WG liked that
- 5424 makes use of structured data but there are few implementations that
strictly adhere to the changes made to the packet header

On the other hand, everyone likes structured data and I've seen it used in
many places.  As far as I know, there have been no efforts to standardize
structured data but people are using it in many places because it is very
versatile and efficient, and it gets the job done.  :-)

I've been working (off and on and hopefully more 'on' soon) on an ID that
explains how non-standardized messages have been conveyed in
IETF-documented protocols.  It will need a couple of more revisions before
it's ready for consideration for publication but you may get some ideas
from it.
  https://datatracker.ietf.org/doc/draft-lonvick-private-tax/?include_text=1

Best regards,
Chris


On Thu, Jul 31, 2014 at 6:19 AM, Lange, Jeffrey K (GE Energy Management) <
[e-mail]> wrote:

> Benoit,
>   We (GE MDS) support 5424/5425/5426 structured messages on our products
> (with vendor specific structured-data).
>
> -Jeff Lange
>
>
>
> From: Benoit Claise <[e-mail]<mailto:[e-mail]>>
> Date: Wednesday, July 30, 2014 at 11:21 AM
> To: Jeffrey Haas <[e-mail]<mailto:[e-mail]>>
> Cc: "[e-mail]<mailto:[e-mail]>" <[e-mail]
> <mailto:[e-mail]>>, Kiran Agrahara Sreenivasa
> <[e-mail]<mailto:[e-mail]>>, "[e-mail]
> <mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>, "
> [e-mail]<mailto:[e-mail]>" <
> [e-mail]<mailto:[e-mail]>>
> Subject: Re: [netmod] Syslog YANG Model Presentation
>
> Jeff,
>
> Thanks.
> So I guess we need to support RFC 5424, RFC 5425, and RFC 5426
> configuration in the YANG model, right?
> You use only vendor specific STRUCTURED-DATA? Because I don't see many in
> the IANA registry<
> http://www.iana.org/assignments/syslog-parameters/syslog-parameters.xhtml#syslog-parameters-4>,
> and http://tools.ietf.org/html/rfc5424#section-9.2 requests IANA
> registration.
>
> If my memory serves me well (I copied a couple of old timers), the
> STRUCTURED-DATA goal was to standardize the syslog message content in the
> industry, but that did not happen.
>
> Regards, Benoit
>
> Benoit,
>
> On Tue, Jul 22, 2014 at 01:34:11PM -0400, Benoit Claise wrote:
>
>
> PS: I think you should also refer to the standards-track version of
>     SYSLOG (RFC 5424) in the references and perhaps filters should
>     also be able to operate on structured content.
>
>
> Is RFC 5424 actually deployed?
>
>
> Juniper has supported it for years.
>
> -- Jeff
> .
>
>
>
>