[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Syslog-sec] SNMP parameters in syslog message - sequenceId
I still see zero as best avoided since in many places (but by no means all) it
carries overtones of this does not exist, has not been set to a valid value, is
an escape etc etc.
If the range is -214783648..214783647, then I agree, zero might as well be
included but by the same token, I would avoid negative numbers unless there is a
strong case for them (which I do not see).
I see the flavour of syslog as being user friendly, easy to read (hence the use
of ASCII) and so avoiding negative numbers and zero fits in with that. I see
SNMPv3 and its use of sequence numbers as ..... magnificently different? and not
always the paradigm to follow.
Tom Petch
----- Original Message -----
From: "David B Harrington" <ietfdbh@comcast.net>
To: "'Rainer Gerhards'" <rgerhards@hq.adiscon.com>; <syslog-sec@employees.org>
Sent: Thursday, April 14, 2005 5:49 PM
Subject: RE: [Syslog-sec] SNMP parameters in syslog message - sequenceId
> Hi,
>
> I'm going to disagree that this should start at and rollover to 1
> "because that's the way SNMP does it".
> The RFC2578 SMIv2 recommendation of starting at 1 rather than 0 is for
> enumerations, not message identifiers.
>
> The SNMP request-id does not start at 1, and roll over to 1.
> >From RFC3416:
> PDU ::= SEQUENCE {
> request-id INTEGER (-214783648..214783647),
>
> [the range used is due to the fact that the ASN.1 INTEGER type is a
> 32-bit signed value, not unsigned. If syslog uses unsigned encoding,
> the 0..4294967295 range is fine.]
>
> David Harrington
> dbharrington@comcast.net
> co-chair IETF SNMPv3 WG, concluded
>
>
> > -----Original Message-----
> > From: syslog-sec-bounces@www.employees.org
> > [mailto:syslog-sec-bounces@www.employees.org] On Behalf Of
> > Rainer Gerhards
> > Sent: Thursday, April 14, 2005 11:27 AM
> > To: syslog-sec@employees.org
> > Subject: RE: [Syslog-sec] SNMP parameters in syslog message -
> > sequenceId
> >
> > Tom,
> >
> > thanks for the reply and the text suggestion. Changed it according
> to
> > your suggested text which exactly described what I wanted to
> > suggest ;)
> > As a thanks, I've also change the ID to "sequenceId" - if others
> > complain, I can change it back. I've now reserved 0 for special
> cases,
> > which means the rollover is also to 1 and not to 0.
> >
> > The text now reads as follows:
> >
> > ####
> > 7.3.1 sequenceId
> >
> > The "sequenceId" parameter allows to track the sequence in
> > which the
> > sender sent the messages. It is an integer that MUST be set to 1
> > when the syslog function is started and MUST be
> > increased with every
> > message up to a maximum value of 4,294,967,295. If that value is
> > reached, the next message must be sent with a sequenceId of 1.
> > ####
> >
> > Rainer
> >
> > > -----Original Message-----
> > > From: Tom Petch [mailto:nwnetworks@dial.pipex.com]
> > > Sent: Monday, April 11, 2005 10:15 PM
> > > To: Rainer Gerhards; syslog
> > > Subject: Re: [Syslog-sec] SNMP parameters in syslog message -
> > > sequenceId
> > >
> > > <inline>
> > > Tom Petch
> > >
> > > ----- Original Message -----
> > > From: "Rainer Gerhards" <rgerhards@hq.adiscon.com>
> > > To: <syslog-sec@employees.org>
> > > Sent: Friday, April 08, 2005 11:24 AM
> > > Subject: [Syslog-sec] SNMP parameters in syslog message
> > > (renamed subject)
> > >
> > >
> > > <snip>
> > > 7.3.1 sequenceID
> > >
> > > The "sequenceID" parameter allows to track the sequence in
> > > which the
> > > sender sent the messages. It is an integer that MUST be
> > reset to 0
> > > at reboot and MUST be monotnically incremented with each
> message
> > > sent. Its maximum value is 4,294,967,295. If that value
> > > is reached,
> > > the next message must be emited with a sequenceID of 0.
> > >
> > > Uh huh. Everywhere, I look monotonic has the same,
> > > well-defined meaning which is
> > > that the value only changes in one direction. So
> > > 99 77 23 5 5 5 3 3 1 -1
> > > is a monotonic sequence as is
> > > 1 1 1 2 2 3 3 3 5 7 68 79 123
> > > To quote Merriam-Webster,
> > > " having the property either of never increasing or of never
> > > decreasing as the
> > > values of the independent variable or the subscripts of the
> > > terms increase
> > > <monotonic functions> <a monotonic sequence>"
> > >
> > > Some words change their meaning as they travel around the
> > > world but I do not
> > > think this is one of them:-)
> > >
> > > If you want each value to be greater than (not greater than
> > > or equal to) the
> > > previous one, then I
> > > think you want 'strictly increasing' but I would suggest instead
> > > 'It is an integer that MUST be set to 0 when the syslog
> > > function is started and
> > > MUST be increased with every message up to a maximum value of
> > > 4,294,967,295. If
> > > that value is reached, the next message must be sent with a
> > > sequenceID of 0.'
> > >
> > > But I also question the use of zero; zero is special, best
> > > avoided unless really
> > > wanted (as in SNMP index values and enumerations) so I
> > > suggest starting at one.
> > >
> > > And I would prefer sequenceId to sequenceID (perhaps because
> > > I use so much
> > > Snmp:-)
> > >
> > >
> > >
> > >
> > _______________________________________________
> > Syslog-sec mailing list
> > Syslog-sec@www.employees.org
> > http://www.employees.org/mailman/listinfo/syslog-sec
> >
>
>
> _______________________________________________
> Syslog-sec mailing list
> Syslog-sec@www.employees.org
> http://www.employees.org/mailman/listinfo/syslog-sec
_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec