Re: [Syslog] [OPSAWG] Syslog message to Remote Rerver

Hi Christopher,
      Sorry for not making my previous post clear. 
My point was since syslogs are tried up mostly with the base/OS layer , hence it comes pretty much earlier than the management plane comes up . And remote logging comes in picture when management plane comes up . Should syslog's be so reliable that we buffer them (in case of udp protocol) or maintain sessions (in case of tcp) (and maintain sessions during failover/switchovers) so that once management plane comes up , we send previous messages also. 

I am not talking on replacing syslogs with traps , and I agree it will be a hazard to purpose also .  My point was just like SNMP lies on management plane and hence is tightly coupled with the outgoing/exit interfaces , so it makes it more reliable in case of remote logging of traps . 

-Aditya dogra

-----Original Message-----
From: Christopher LILJENSTOLPE [mailto:liljenstolpe@gmail.com] 
Sent: Monday, February 25, 2013 9:56 AM
To: Aditya Dogra (addogra)
Cc: syslog@ietf.org; opsawg@ietf.org
Subject: Re: [OPSAWG] Syslog message to Remote Rerver

Greetings Aditya,

	Can I ask for a little more clarity as to what you are asking?  Are you asking the operational community for their expectations on syslog message reliability (it seems so in (a), or are you making a statement that you do not believe that the reliability is not sufficient (your earlier comments)?  Also, you mention in (b) that SNMP is there.  That is true - are you proposing that SNMP be used to augment syslog (if so, I would hazard to guess that that is already a solution that is widely deployed).

	Thank's,
	Christopher

On 21Feb2013, at 08.25, Aditya Dogra (addogra) <addogra@cisco.com> wrote:

> Hi All ,
> 
> Currently syslog messages collected locally on the network device are transmitted to the remote syslog servers as per RFC 5424 (UDP protocol used for transmission) and RFC 3195 (TCP protocol used for transmission)
> 
> However, we have observed that increasingly, customers are using syslog messages archived in the remote server for business logic .
> 
> In some networks, it is possible that some of the syslog messages may be dropped due to link failure or other network conditions.
> However, the customers are expecting much higher resiliency for the syslog messages.
> 
> 
> The questions we seek clarification are:
> 
> a)         What are the expectations from the external syslog delivery?
> 
> b)         Should we rely on syslog's alone ? Please note that SNMP traps functionality for network management is also there.?
> 
> 
> Your thoughts and suggestions much appreciated.
> 
> 
> Regards,
> Aditya dogra
> 
> 
> _______________________________________________
> OPSAWG mailing list
> OPSAWG@ietf.org
> https://www.ietf.org/mailman/listinfo/opsawg

--  
李柯睿
Check my PGP key here: https://www.asgaard.org/~cdl/cdl.asc
Current vCard here: https://www.asgaard.org/~cdl/cdl.vcf
Check my calendar availability: https://tungle.me/cdl