[OPSAWG] discuss on draft-ietf-opsawg-syslog-msg-mib-06.txt

[Juergen Schoenwaelder <[e-mail]>]

Hi,

during the IESG review of draft-ietf-opsawg-syslog-msg-mib-06.txt,
Adrian Farrel raised a DISCUSS concerning the syslogMsgTable that we
have not managed to clear yet and where we seek input from the WG.

The syslogMsgTable is index by syslogMsgIndex, an unsigned index
number that is increases when entries are added and which rolls over
if the index number space has been exceeded. This means that the
entries in the table are (ignoring roll overs here) in the order they
were inserted (which is not necessarily the timestamp order of the
syslog events). This supports the following "tail -f" use case where a
management application initially reads the table, remembers the end of
the table and during the next poll starts at the last remembered index
position. This is useful to quickly check for additions to the
table. This approach also works with index roll overs unless the table
rolls over multiple times during a polling cycle.

Adrian Farrel asks in his DISCUSS whether there is not also a use case
to read the table in index order, that is oldest table entry to most
recent table entry, according to table insertion order. Right now,
this only works until the first index rollover occurs since after the
first index rollover, top table entries might be more recent than
bottom table entries. This can be fixed for example by adding an
additional scalar object reporting the index of the oldest entry in
the table.

As the editor of the document, I did not feel entitled to make a
decision on this issue. After talking with Scott Bradner, we believe
the WG needs to decide whether the ability to quickly find the oldest
entry in the table (according to the insertion time) is a feature the
MIB module needs to support. An important detail to consider here is
that the table insertion order is not necessarily syslog timestamp
order.

/js

PS: Adrian, please correct me if my summary of your DISCUSS is
    incorrect or unclear.

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1, 28759 Bremen, Germany
Fax:   [phone]         <http://www.jacobs-university.de/>