Re: [sip-clf] A primer on syslog.

"Rainer Gerhards" <rgerhards@hq.adiscon.com> Thu, 04 February 2010 11:50 UTC

Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Thu, 04 Feb 2010 12:51:36 +0100
Message-ID: <9B6E2A8877C38245BFB15CC491A11DA7103809@GRFEXC.intern.adiscon.com>
Thread-Topic: [sip-clf] A primer on syslog.
Thread-Index: AcqlMKjUR8HC0H1jRmer31mp3poB9QAXxsVw
References: <7505A2C58D8F4FD88B47D10EA74649CD@china.huawei.com><00ce01caa41e$fe5a5ef0$0600a8c0@china.huawei.com><4B68920B.5090908@alcatel-lucent.com><81F3AF977ADD49E7A883F138ECCC71D0@china.huawei.com><01eb01caa4ec$0fbe0930$0600a8c0@china.huawei.com><DCBC0046E3434E519A2E9EDB4071C7B6@china.huawei.com><023501caa50a$16943c70$0600a8c0@china.huawei.com> <A90FB013-09CB-43B3-A7AC-7F7A27F9EF6B@cisco.com>
From: Rainer Gerhards <rgerhards@hq.adiscon.com>
To: Cullen Jennings <fluffy@cisco.com>
Cc: SIP-CLF Mailing List <sip-clf@ietf.org>
Subject: Re: [sip-clf] A primer on syslog.
Precedence: list

> -----Original Message-----
> From: sip-clf-bounces@ietf.org [mailto:sip-clf-bounces@ietf.org] On
> Behalf Of Cullen Jennings
> Sent: Thursday, February 04, 2010 1:26 AM
> To: David Harrington
> Cc: SIP-CLF Mailing List
> Subject: Re: [sip-clf] A primer on syslog.
> 
> 
> On Feb 3, 2010, at 12:50 PM, David Harrington wrote:
> 
> > There are 23
> > different facilities defined for use in the <priority field>, ranging
> > from "kernel" to system daemons to mail to security to local
> > applications. A SIP application would use one of the "local"
> > facilities to log messages.
> 
> 
> 
> Just out of curiosity, would it ever make sense for the IETF to
> designate an facilities value for SIP?

Actually, the syslog WG was (very unfortunately) forced to stick with this
too-small set of facilities in order to keep compatible with existing
implementations. Other than facility 0, which seems to be universally used by
the OS kernel, there is no exact semantic for the facility codes. Think about
how many important subsystems we have and how small this facility set is...
The rest of the header provides ample ways to express this is a sip packet,
but an operator will still assign a facility and filter on it simply because
that is the fastest way to do it. This is another thing where some operator
configuration is required, at least in a reasonable busy envrionment.

Rainer

[sip-clf] WGLC: SIPCLF Problem Statement (draft-g… Spencer Dawkins
Re: [sip-clf] WGLC: SIPCLF Problem Statement(draf… Spencer Dawkins
Re: [sip-clf] WGLC: SIPCLF Problem Statement(draf… Elwell, John
Re: [sip-clf] WGLC: SIPCLF ProblemStatement(draft… Spencer Dawkins
Re: [sip-clf] WGLC: SIPCLF ProblemStatement(draft… Eric Burger
Re: [sip-clf] WGLC: SIPCLF Problem Statement(draf… David Harrington
Re: [sip-clf] WGLC: SIPCLF Problem Statement(draf… Spencer Dawkins
Re: [sip-clf] WGLC: SIPCLF Problem Statement(draf… Vijay K. Gurbani
Re: [sip-clf] WGLC: SIPCLF ProblemStatement(draft… Spencer Dawkins
Re: [sip-clf] WGLC: SIPCLF ProblemStatement(draft… Romascanu, Dan (Dan)
Re: [sip-clf] WGLC: SIPCLF ProblemStatement(draft… David Harrington
Re: [sip-clf] WGLC: SIPCLF ProblemStatement(draft… Spencer Dawkins
Re: [sip-clf] WGLC: SIPCLFProblemStatement(draft-… Rainer Gerhards
[sip-clf] A primer on syslog. David Harrington
Re: [sip-clf] A primer on syslog. Rainer Gerhards
Re: [sip-clf] A primer on syslog. Spencer Dawkins
Re: [sip-clf] A primer on syslog. Cullen Jennings
[sip-clf] WGLC: SIPCLF Problem Statement (draft-g… Cullen Jennings
Re: [sip-clf] WGLC: SIPCLF Problem Statement(draf… Rainer Gerhards
Re: [sip-clf] A primer on syslog. Rainer Gerhards
Re: [sip-clf] WGLC: SIPCLF Problem Statement(draf… Benoit Claise
Re: [sip-clf] WGLC: SIPCLF Problem Statement (dra… Vijay K. Gurbani
Re: [sip-clf] WGLC: SIPCLF Problem Statement (dra… Hadriel Kaplan
Re: [sip-clf] WGLC: SIPCLF Problem Statement (dra… Vijay K. Gurbani