Subject: Re: [OPSAWG] Proposed update to syslog Alarm

From: Juergen Schoenwaelder <[email-masked]>
Date: Sun, 1 Feb 2009 14:33:47 +0100

On Fri, Jan 30, 2009 at 11:18:04AM -0500, Sharon Chisholm wrote:
 
> Attached is the propose update to the Syslog Alarm draft as a result of
> comments received during working group last call. I believe it addresses
> all known issues.
> 
> Please let me know if you have any comments or corrections and I can
> make any necessary changes before posting this as version -02.

- Capitalize the section 1.1 heading or get rid of the heading
  and make the two sentences part of section 1.

- You sometimes use "resource" and sometimes "alarmResource",
  please pick one an be consistent.

- Section 3.6 is confusing - we now have three resource identifiers:

  (1) resource (or alarmResource)

      The specification leaves it open what it contains; so this value
      is really just for humans to read.

  (2) resourceOID

      This SD-ID contains an OID, namely the value of the
      alarmActiveResourceId MIB object. This SD-ID suffers from the
      problem that it does not carry SNMP context information and is
      thus ambiguous.

  (3) resourceURI

      This is defined to hold an SNMP URI. This solved the missing
      SNMP context problem of resourceOID but fires back in the sense
      that it can't carry other URIs.

  My proposal is to keep (1), delete (2), and to change (3) such that
  it can carry arbitrary URIs and can appear multiple times. If an
  alarmActiveResourceId MIB object exists, the value should be reported
  using the SNMP URI format in an resourceURI SD-ID.

- In the example, I find it strange to consider "su root" a resource.
  For me, the resource raising the alarm is a subsystem of the OS
  dealing with authorization decisions. Also the message in the
  message part is not likely to be generated when you have an
  unauthorizedAccessAttempt. Please make the example more realistic.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
OPSAWG mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsawg