Subject: [OPSAWG] AD review for draft-ietf-opsawg-syslog-snmp-03.txt and draft-ietf-opsawg-syslog-msg-mib-04.txt

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 25 Jun 2009 12:42:37 +0200

I believe that both documents are ready for IETF Last Call. If no other
comments are being sent to the list I will send the two documents to
IETF Last Call by Sunday 6/29. 

Please consider the comments below together with the other IETF Last
Call comments: 

draft-ietf-opsawg-syslog-snmp-03.txt:

1. In section 2.1: 

  This document assumes that notifications are in the format defined in
   RFC 3416 [RFC3416].  Notifications in the SNMPv1 notification format
   must be translated as described in Section 3.1 of RFC 3584 [RFC3584].

I believe that the text here must use a 2119 MUST and be more clear that
this translation MUST happen on the snmp-to-syslog translator to
accommodate reception and translation of SNMPv1 traps 

2. Sections 3.1 and 3.2 seem to impose requirements on the functionality
and behavior of the snmp-to-syslog translator that are appropriate to be
described with RFC 2119 capitalization. 

3. Why is the BER encoding of the trap included in the usage example in
Section 5?

4. id-nits complains about an obsolete normative reference: RFC 4234
(Obsoleted by RFC 5234)

draft-ietf-opsawg-syslog-msg-mib-04.txt:

1. id-nits complain on a missing reference: 'RFC3412' is mentioned on
line 664, but not  defined

2. It would be nice to write 'SYSLOG to SNMP converter' in a manner
consistent to the way  'snmp-to-syslog translator' is written in the
companion I-D. BTW, is there any reason for calling one 'converter' and
the other 'translator'? 

3. Implementations of this MIB module may truncate the message part of
the syslog message such that it fits into the size constraints imposed
by the implementation environment - how does such truncation happen? Are
all syslog messages on a given converter always truncated at the same
value? Should not this be indicated by a MIB object? 

4. Would not a counter of the number of received syslog messages be
useful for a manager?

5. Security Considerations -Writing on syslogMsgEnableNotifications
involves one more threat - preventing management applications that use
SNMP from receiving real-time notifications about events carried in
syslog messages. 

Thanks and Regards,

Dan