Subject: RE: [Syslog-sec] IETF 60 Meeting and WG Mailing List

From: "Rainer Gerhards" <[email-masked]>
Date: Wed, 16 Jun 2004 11:43:43 +0200

Hi Folks,

a quick status update from my side. I've been out of office for quite a
while and I am now coming back to real work (after a pile of email). I
will create a new draft within the next 3 weeks or so. I'd really
appreciate any more comments if there are. I will work through past
comments soon.

Rainer

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> Chris Lonvick
> Sent: Monday, June 14, 2004 7:56 PM
> To: [email-masked]
> Subject: [Syslog-sec] IETF 60 Meeting and WG Mailing List
> 
> Hi Folks,
> 
> I've been trying to get the IETF people to set up a WG 
> mailing list for us
> to replace the one on employees.org.  I believe that I've 
> sent them all of
> the information but I havn't heard back from them in a few weeks.
> However, it appears that employees.org has gotten a new lease 
> on life and
> so I'll continue here until I get something going on the IETF 
> machines.
> 
> I've had a discussion with Anton and Rainer.  It looks like 
> both IDs are
> getting close to being finished.  I've asked them to wrap up 
> any remaining
> issues and let's get this into WG Last Call.  We need to do a 
> nit check
> but I'm very hopeful that we can get them to the IESG in a 
> few weeks.  I
> think that our time will be better spent in this work rather than in
> preparing for the meeting in San Diego.  As such, I'd like to 
> propose that
> we not have a meeting in San Diego.  Please watch for the new 
> IDs to be
> posted and please comment upon them.
> 
> Thanks,
> Chris
> _______________________________________________
> Syslog-sec mailing list
> [email-masked]
> http://www.employees.org/mailman/listinfo/syslog-sec
> 
_______________________________________________
Syslog-sec mailing list
[email-masked]
http://www.employees.org/mailman/listinfo/syslog-sec

---

From: "Anton Okmianski" <[email-masked]>
Date: Wed, 16 Jun 2004 10:56:06 -0400

Here is my update on syslog-transport.

After posting the last draft, I have not received any substantive
comments. But I had quite a few on the pre-draft version.  Seems like
the draft satisfied all the concerns raised against the earlier
versions.  

Rainer & I talked about his concerns with doing fragmentation the way
we do it now in transport. He would prefer to do it using structured
content within syslog message like the earlier proposals or some other
scheme that pushes the re-assembly on the log processor (analyzer)
instead of every party in transmission (potentially including syslog
relays). 

I am not sure we reached complete consensus yet. But I think, with
fragmentation being optional now (only required for messages over
certain size), both approaches can co-exist. People can use structured
content as they please and break messages, or they could use a syslog
transport implementation which supports fragmentation.  Or just use
small messages and forget about all of this.  

Other than this, the syslog-transport draft is ready to go.

Thanks,
Anton.   

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf 
> Of Rainer Gerhards
> Sent: Wednesday, June 16, 2004 5:44 AM
> Subject: RE: [Syslog-sec] IETF 60 Meeting and WG Mailing List
> 
> 
> Hi Folks,
> 
> a quick status update from my side. I've been out of office 
> for quite a while and I am now coming back to real work 
> (after a pile of email). I will create a new draft within the 
> next 3 weeks or so. I'd really appreciate any more comments 
> if there are. I will work through past comments soon.
> 
> Rainer
> 
> http://www.employees.org/mailman/listinfo/sysl> og-sec
>

---

From: "David B Harrington" <[email-masked]>
Date: Wed, 16 Jun 2004 11:39:43 -0400

Hi,

I have not reviewed the new drafts yet.

I strongly dislike "standards" that say "do it however you want." A standard
should standardize the behavior to be consistent and predictable. Therefore
I would like to see us choose either application-layer-fragmentation or
transport-layer-fragmentation, but not both.

If the transport-layer-fragmentation to which you refer requires the
transport layer to understand syslog messages in any way, or even require
the transport layer to know that a given payload *is* a syslog message, that
would be a violation of the layering principle, and would seem to be a bad
choice. 

Short messages impose the least on both the sender and receiver
implementations, and should be preferred unless short messages really cannot
do the job adequately.

Application-layer-fragmentation would seem to require the user/developer to
do more work to fragment messages, rather than "passing the buck" to the
transport layer. This might lead vendors to use shorter messages, where
adeqaute, to avoid having to do the fragmentation, which I would view as a
good thing. 

Using the 90/10 rule, I suggest making support for long/fragmented messages
optional (despite my belief that standards shouldn't say "do what you
want"). Most implementors will support short messages, and they will be
adequate for 90% of users. For those 10% of device vendors who believe long
messages are really important, and those 10% of receivers that believe
supporting long messages is important, they can suffer the additional
expense of supporting this at the application-layer, without forcing all
implementations to support it.

My $.02

dbh

> Anton Okmianski
> Sent: Wednesday, June 16, 2004 10:56 AM
> After posting the last draft, I have not received any 
> substantive comments. But I had quite a few on the pre-draft 
> version.  Seems like the draft satisfied all the concerns 
> raised against the earlier versions.  
> 
> Rainer & I talked about his concerns with doing fragmentation 
> the way we do it now in transport. He would prefer to do it 
> using structured content within syslog message like the 
> earlier proposals or some other scheme that pushes the 
> re-assembly on the log processor (analyzer) instead of every 
> party in transmission (potentially including syslog relays). 
> 
> I am not sure we reached complete consensus yet. But I think, 
> with fragmentation being optional now (only required for 
> messages over certain size), both approaches can co-exist. 
> People can use structured content as they please and break 
> messages, or they could use a syslog transport implementation 
> which supports fragmentation.  Or just use small messages and 
> forget about all of this.  
> 
> Of Rainer 
> > Gerhards
> for quite 
> > a while and I am now coming back to real work (after a pile 
> of email). 
> > I will create a new draft within the next 3 weeks or so. I'd really 
> > > [mailto:[email-masked]] On Behalf Of Chris 
> > > Lonvick
> mailing list 
> > > for us to replace the one on employees.org.  I believe that I've 
> > > sent them all of the information but I havn't heard back 
> from them 
> > > in a few weeks.
> > > However, it appears that employees.org has gotten a new lease on 
> > > life and so I'll continue here until I get something going on the 
> > > IETF machines.
> > > 
> > > I've had a discussion with Anton and Rainer.  It looks 
> like both IDs 
> > > are getting close to being finished.  I've asked them to 
> wrap up any 
> > > remaining issues and let's get this into WG Last Call.  
> We need to 
> > > do a nit check but I'm very hopeful that we can get them 
> to the IESG 
> > > in a few weeks.  I think that our time will be better 
> spent in this 
> > > work rather than
> in
> > > propose that we not have a meeting in San Diego.  Please 
> watch for 
> > > the new IDs to be posted and please comment upon them.
> > > 
> > > Thanks,
> > > Chris