Subject: [OPSAWG] syslog-msg-mib & opsawg-syslog-snmp

From: Rainer Gerhards <[email-masked]>
Date: Tue, 24 Feb 2009 17:29:29 +0100

I wonder if a provision should be made in syslog-msg-mib that the
original notification should be restored if the syslog message
received is in the format specificed by syslog-snmp. That could be the
case if - for whatever reasons - a SNMP notification is tunneled over
a syslog link. While this sounds unrealistic, it may be useful to at
least provide a hint what to do in such cases.

Rainer

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 24 Feb 2009 17:36:17 +0100

> least provide a hint what to do in such cases.

There is also the other case of a SYSLOG message tunneled over an SNMP
notification link. Yes, it may sounds strange for most people to think
about such constructions but I would not be surprised if people find
reasons to deploy such things, especially if notifications have to
cross organizational boundaries and different tool chains.

So far there is no text about these situations in the documents but
part of my argumentation on this list for having translations that do
not loose information stems from the fact that I like to have
reversible translations that will work in such scenarios. Perhaps we
should make this explicit.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Rainer Gerhards <[email-masked]>
Date: Tue, 24 Feb 2009 17:54:05 +0100

> should make this explicit.

I think making it explicit would be useful.

Rainer

---

From: WashamFan <[email-masked]>
Date: Wed, 25 Feb 2009 12:03:48 +0800

Hi, Juergen

Are you sure reversible translations are not loosing infomation?
If yes, it is not necessary to state explicitly tunnel cases.
Anyway, I can live with that.

washam

>  _______________________________________________
>  OPSAWG mailing list
>  [email-masked]
>  https://www.ietf.org/mailman/listinfo/opsawg
>

---

From: Rainer Gerhards <[email-masked]>
Date: Wed, 25 Feb 2009 09:56:42 +0100

> Are you sure reversible translations are not loosing infomation?

I think this can not be outruled, at least least in the snmp -> syslog
-> snmp case. The reason here is that syslog message size constraints
may cause loss of some elements.

That's also the reason why I think it would be useful to state this
use case explicitly, this enables us to specify some constraints.

Rainer
>>  > On Tue, Feb 24, 2009 at 05:29:29PM +0100, Rainer Gerhards wrote:
>>  >
>>  >> I wonder if a provision should be made in syslog-msg-mib that the
>>  >> original notification should be restored if the syslog message
>>  >> received is in the format specificed by syslog-snmp. That could be
>> the
>>  >> case if - for whatever reasons - a SNMP notification is tunneled over
>>  >> a syslog link. While this sounds unrealistic, it may be useful to
>> at
>>  >> least provide a hint what to do in such cases.
>>  >
>>  > There is also the other case of a SYSLOG message tunneled over an SNMP
>>  > notification link. Yes, it may sounds strange for most people to think
>>  > about such constructions but I would not be surprised if people find
>>  > reasons to deploy such things, especially if notifications have to
>>  > cross organizational boundaries and different tool chains.
>>  >
>>  > So far there is no text about these situations in the documents but
>>  > part of my argumentation on this list for having translations that
>> do
>>  > not loose information stems from the fact that I like to have
>>  > reversible translations that will work in such scenarios. Perhaps we
>>  > should make this explicit.
>>