Re: [OPSAWG] discuss on draft-ietf-opsawg-syslog-msg-mib-06.txt

["David Harrington" <[e-mail]>]

Hi,

The SNMP approach has a major guideline:
keep the agent simple; move complexity to the manager.

I think that different applications will want different orderings, and
that the applications should sort based on their preference rather
than forcing this onto the agent. I do not believe there is
significant operational benefit from knowing insertion order.

Do entries ever get removed from this table? Does rollover just
overwrite starting at the beginning of the table? Is there ever a case
where the newer entries get interlaced with older entries?

I am not sure I see the benefits of knowing where the oldest entry is.
I think most uses will want the whole table so they can sort it by
whatever criteria it needs. I can see a few edge cases (like having
oldest=0 might imply no rollover has occurred), but nothing
compelling. In the case of wanting to only get updated rows, I would
think knowing where the most recent entry is might be more useful than
knowing where the oldest entry is, so you know where to stop reading,
even if there has been no rollover. This seems to add complexity to
the agent that might not be needed. The manager can simply look at
each getNext retrieval to see if it already has that entry. But a
scalar is fairly simple to add, so I wouldn't object if it got added.

dbh

> -----Original Message-----
> From: [e-mail] 
> [mailto:[e-mail]] On Behalf Of Juergen Schoenwaelder
> Sent: Friday, August 28, 2009 9:06 AM
> To: [e-mail]
> Cc: Adrian Farrel
> Subject: [OPSAWG] discuss on draft-ietf-opsawg-syslog-msg-mib-06.txt
> 
> Hi,
> 
> during the IESG review of draft-ietf-opsawg-syslog-msg-mib-06.txt,
> Adrian Farrel raised a DISCUSS concerning the syslogMsgTable that we
> have not managed to clear yet and where we seek input from the WG.
> 
> The syslogMsgTable is index by syslogMsgIndex, an unsigned index
> number that is increases when entries are added and which rolls over
> if the index number space has been exceeded. This means that the
> entries in the table are (ignoring roll overs here) in the order
they
> were inserted (which is not necessarily the timestamp order of the
> syslog events). This supports the following "tail -f" use case where
a
> management application initially reads the table, remembers the end
of
> the table and during the next poll starts at the last remembered
index
> position. This is useful to quickly check for additions to the
> table. This approach also works with index roll overs unless the
table
> rolls over multiple times during a polling cycle.
> 
> Adrian Farrel asks in his DISCUSS whether there is not also a use
case
> to read the table in index order, that is oldest table entry to most
> recent table entry, according to table insertion order. Right now,
> this only works until the first index rollover occurs since after
the
> first index rollover, top table entries might be more recent than
> bottom table entries. This can be fixed for example by adding an
> additional scalar object reporting the index of the oldest entry in
> the table.
> 
> As the editor of the document, I did not feel entitled to make a
> decision on this issue. After talking with Scott Bradner, we believe
> the WG needs to decide whether the ability to quickly find the
oldest
> entry in the table (according to the insertion time) is a feature
the
> MIB module needs to support. An important detail to consider here is
> that the table insertion order is not necessarily syslog timestamp
> order.
> 
> /js
> 
> PS: Adrian, please correct me if my summary of your DISCUSS is
>     incorrect or unclear.
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: [phone]         Campus Ring 1, 28759 Bremen, Germany
> Fax:   [phone]         <http://www.jacobs-university.de/>
> _______________________________________________
> OPSAWG mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/opsawg
>