Re: [netmod] Syslog YANG Model Presentation

[Benoit Claise <[e-mail]>]

Dear all,

As I understand, the conclusion from this email thread is that the 
syslog YANG model must support the options for RFC 5424, RFC 5425, and 
RFC 5426

Regards, Benoit
> Hi,
> The very brief background:
> - the syslog WG was chartered under the Security Area to secure the 
> protocol
> - the BEEP work never took off so we rechartered and found that we 
> needed to make changes to the protocol itself
> - in making the changes, Rainer Gerhards proposed structured data and 
> the WG liked that
> - 5424 makes use of structured data but there are few implementations 
> that strictly adhere to the changes made to the packet header
>
> On the other hand, everyone likes structured data and I've seen it 
> used in many places.  As far as I know, there have been no efforts to 
> standardize structured data but people are using it in many places 
> because it is very versatile and efficient, and it gets the job done.  :-)
>
> I've been working (off and on and hopefully more 'on' soon) on an ID 
> that explains how non-standardized messages have been conveyed in 
> IETF-documented protocols.  It will need a couple of more revisions 
> before it's ready for consideration for publication but you may get 
> some ideas from it.
> https://datatracker.ietf.org/doc/draft-lonvick-private-tax/?include_text=1
>
> Best regards,
> Chris
>
>
> On Thu, Jul 31, 2014 at 6:19 AM, Lange, Jeffrey K (GE Energy 
> Management) <[e-mail] <mailto:[e-mail]>> 
> wrote:
>
>     Benoit,
>       We (GE MDS) support 5424/5425/5426 structured messages on our
>     products (with vendor specific structured-data).
>
>     -Jeff Lange
>
>
>
>     From: Benoit Claise <[e-mail]
>     <mailto:[e-mail]><mailto:[e-mail]
>     <mailto:[e-mail]>>>
>     Date: Wednesday, July 30, 2014 at 11:21 AM
>     To: Jeffrey Haas <[e-mail]
>     <mailto:[e-mail]><mailto:[e-mail]
>     <mailto:[e-mail]>>>
>     Cc: "[e-mail]
>     <mailto:[e-mail]><mailto:[e-mail]
>     <mailto:[e-mail]>>" <[e-mail]
>     <mailto:[e-mail]><mailto:[e-mail]
>     <mailto:[e-mail]>>>, Kiran Agrahara Sreenivasa
>     <[e-mail]<mailto:[e-mail]
>     <mailto:[e-mail]>>>, "[e-mail]
>     <mailto:[e-mail]><mailto:[e-mail]
>     <mailto:[e-mail]>>" <[e-mail]
>     <mailto:[e-mail]><mailto:[e-mail]
>     <mailto:[e-mail]>>>, "[e-mail]
>     <mailto:[e-mail]><mailto:[e-mail]
>     <mailto:[e-mail]>>" <[e-mail]
>     <mailto:[e-mail]><mailto:[e-mail]
>     <mailto:[e-mail]>>>
>     Subject: Re: [netmod] Syslog YANG Model Presentation
>
>     Jeff,
>
>     Thanks.
>     So I guess we need to support RFC 5424, RFC 5425, and RFC 5426
>     configuration in the YANG model, right?
>     You use only vendor specific STRUCTURED-DATA? Because I don't see
>     many in the IANA
>     registry<http://www.iana.org/assignments/syslog-parameters/syslog-parameters.xhtml#syslog-parameters-4>,
>     and http://tools.ietf.org/html/rfc5424#section-9.2 requests IANA
>     registration.
>
>     If my memory serves me well (I copied a couple of old timers), the
>     STRUCTURED-DATA goal was to standardize the syslog message content
>     in the industry, but that did not happen.
>
>     Regards, Benoit
>
>     Benoit,
>
>     On Tue, Jul 22, 2014 at 01:34:11PM -0400, Benoit Claise wrote:
>
>
>     PS: I think you should also refer to the standards-track version of
>         SYSLOG (RFC 5424) in the references and perhaps filters should
>         also be able to operate on structured content.
>
>
>     Is RFC 5424 actually deployed?
>
>
>     Juniper has supported it for years.
>
>     -- Jeff
>     .
>
>
>
>