Subject: [Int-area] I-D Action:draft-ietf-intarea-server-logging-recommendations-00.txt

From: [email-masked]
Date: Thu, 09 Dec 2010 09:15:01 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Internet Area Working Group Working Group of the IETF.

	Title           : Logging recommendations for Internet facing servers
	Author(s)       : A. Durand, et al.
	Filename        : draft-ietf-intarea-server-logging-recommendations-00.txt
	Pages           : 6
	Date            : 2010-12-09

In the wake of IPv4 exhaustion and deployment of IP address sharing
techniques, this document recommends that Internet facing servers log
port number and accurate timestamps in addition to the incoming IP
address.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-intarea-server-logging-recommendations-00.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: "George, Wes E [NTK]" <[email-masked]>
Date: Fri, 10 Dec 2010 15:04:06 +0000

Just to echo the comments I made at the mic in Beijing, I don't believe that
the current text regarding timestamp (accurate to the second) is adequate on
its own, because without a reference point, accuracy is relative.

There needs to be a specific requirement (I say MUST, but I'd be ok with a
SHOULD) for NTP clock sync, at least stratum 3.

Also, in re-reading the draft, I'm not sure why we're specifying timezones
instead of simply saying SHOULD be UTC, MAY use localtime if the UTC offset
is specified.

Thanks, 
Wes George

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of [email-masked]
> Sent: Thursday, December 09, 2010 12:15 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [Int-area] I-D Action:draft-ietf-intarea-server-logging-
> recommendations-00.txt
>

---

From: Alain Durand <[email-masked]>
Date: Fri, 10 Dec 2010 07:46:52 -0800

> instead of simply saying SHOULD be UTC, MAY use localtime if the UTC offset

Wes,

Thanks for the input. I do not think we can use MUST here, but we can certainly recommend it.

 - Alain.

---

From: Joel Jaeggli <[email-masked]>
Date: Fri, 10 Dec 2010 10:27:10 -0800

> its own, because without a reference point, accuracy is relative.

	2.

	   o  A timestamp accurate to the second, with associated time
		zone.

> SHOULD) for NTP clock sync, at least stratum 3.

it's really a requirement for a traceability to a utc time-source with a
maximum deviation of one second, it doesn't really matter how that's
implemented.

I would propose:

	 o  A UTC or localtime with UTC-offset timestamp accurate to
		the second from a traceable time source.

> instead of simply saying SHOULD be UTC, MAY use localtime if the UTC offset

+1

>> _______________________________________________
>> Int-area mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/int-area