Re: [OPSAWG] discuss on draft-ietf-opsawg-syslog-msg-mib-06.txt

[Adrian Farrel <[e-mail]>]

David,

Thanks for that input. It almost closes the issue for me.

Two minor points:

1.
> Do entries ever get removed from this table?
Not as I understand it. The index is monotonic increasing and wraps at the 
maximum value (defined as the lesser of syslogMsgTableMaxSize and 
4294967295).
> Does rollover just overwrite starting at the beginning of the table?
Yes.
> Is there ever a case where the newer entries get interlaced with older 
> entries?
Not unless someone screws up.

2.
> The SNMP approach has a major guideline:
> keep the agent simple; move complexity to the manager.
Yes. And this is what swings it for me.
I am just left wondering whether an Agent is more loaded by a bulk read of 
10,000 entries or maintaining a pointer into the table.

Clear up this last point, and I'm done.

Cheers,
Adrian



----- Original Message ----- 
From: "David Harrington" <[e-mail]>
To: "'Juergen Schoenwaelder'" <[e-mail]>; 
[e-mail]
Cc: "'Adrian Farrel'" <[e-mail]>
Sent: Friday, August 28, 2009 3:59 PM
Subject: RE: [OPSAWG] discuss on draft-ietf-opsawg-syslog-msg-mib-06.txt


> Hi,
>
> The SNMP approach has a major guideline:
> keep the agent simple; move complexity to the manager.
>
> I think that different applications will want different orderings, and
> that the applications should sort based on their preference rather
> than forcing this onto the agent. I do not believe there is
> significant operational benefit from knowing insertion order.
>
> Do entries ever get removed from this table? Does rollover just
> overwrite starting at the beginning of the table? Is there ever a case
> where the newer entries get interlaced with older entries?
>
> I am not sure I see the benefits of knowing where the oldest entry is.
> I think most uses will want the whole table so they can sort it by
> whatever criteria it needs. I can see a few edge cases (like having
> oldest=0 might imply no rollover has occurred), but nothing
> compelling. In the case of wanting to only get updated rows, I would
> think knowing where the most recent entry is might be more useful than
> knowing where the oldest entry is, so you know where to stop reading,
> even if there has been no rollover. This seems to add complexity to
> the agent that might not be needed. The manager can simply look at
> each getNext retrieval to see if it already has that entry. But a
> scalar is fairly simple to add, so I wouldn't object if it got added.
>
> dbh
>
>> -----Original Message-----
>> From: [e-mail]
>> [mailto:[e-mail]] On Behalf Of Juergen Schoenwaelder
>> Sent: Friday, August 28, 2009 9:06 AM
>> To: [e-mail]
>> Cc: Adrian Farrel
>> Subject: [OPSAWG] discuss on draft-ietf-opsawg-syslog-msg-mib-06.txt
>>
>> Hi,
>>
>> during the IESG review of draft-ietf-opsawg-syslog-msg-mib-06.txt,
>> Adrian Farrel raised a DISCUSS concerning the syslogMsgTable that we
>> have not managed to clear yet and where we seek input from the WG.
>>
>> The syslogMsgTable is index by syslogMsgIndex, an unsigned index
>> number that is increases when entries are added and which rolls over
>> if the index number space has been exceeded. This means that the
>> entries in the table are (ignoring roll overs here) in the order
> they
>> were inserted (which is not necessarily the timestamp order of the
>> syslog events). This supports the following "tail -f" use case where
> a
>> management application initially reads the table, remembers the end
> of
>> the table and during the next poll starts at the last remembered
> index
>> position. This is useful to quickly check for additions to the
>> table. This approach also works with index roll overs unless the
> table
>> rolls over multiple times during a polling cycle.
>>
>> Adrian Farrel asks in his DISCUSS whether there is not also a use
> case
>> to read the table in index order, that is oldest table entry to most
>> recent table entry, according to table insertion order. Right now,
>> this only works until the first index rollover occurs since after
> the
>> first index rollover, top table entries might be more recent than
>> bottom table entries. This can be fixed for example by adding an
>> additional scalar object reporting the index of the oldest entry in
>> the table.
>>
>> As the editor of the document, I did not feel entitled to make a
>> decision on this issue. After talking with Scott Bradner, we believe
>> the WG needs to decide whether the ability to quickly find the
> oldest
>> entry in the table (according to the insertion time) is a feature
> the
>> MIB module needs to support. An important detail to consider here is
>> that the table insertion order is not necessarily syslog timestamp
>> order.
>>
>> /js
>>
>> PS: Adrian, please correct me if my summary of your DISCUSS is
>>     incorrect or unclear.
>>
>> -- 
>> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
>> Phone: [phone]         Campus Ring 1, 28759 Bremen, Germany
>> Fax:   [phone]         <http://www.jacobs-university.de/>
>> _______________________________________________
>> OPSAWG mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/opsawg
>>
>
>