[Syslog-sec] RE: SD-ID in draft-ietf-syslog-protocol-11.txt

["Rainer Gerhards" <rgerhards@hq.adiscon.com>]

Tom,

thanks for your suggestions. Comments below...

> I would like the section on SD-ID to be more precise on 
> acceptable formats.
> 
> enterpriseID (enterpriseId? p.41 does say 'This document uses 
> "camel case"
> consistently' ) allows multiple sub-identifiers but does not
> specify a textual representation or a separator.  I assume 
> decimal number and
> period, eg
> "9.1.30"
> "11.2.3.7.5.12"
> but think this should be spelt out

changed as follows:

####
7.2.2  enterpriseId

   The "enterpriseId" parameter MUST be a 'SMI Network Management
   Private Enterprise Code', maintained by IANA, whose prefix is
   iso.org.dod.internet.private.enterprise (1.3.6.1.4.1).  The number
   that follows is unique and may be registered by an on-line form at
   <http://www.iana.org/>.  Only that number and any-enterprise assigned
   ID below it MUST be specified in the "enterpriseId" parameter.  If
   sub-identifiers are used, they MUST be separated by periods and be
   represented as decimal numbers ("9.1.30" and "11.2.3.7.5.12").  The
   complete up-to-date list of Enterprise Numbers is maintained by IANA
   at <http://www.iana.org/assignments/enterprise-numbers>.

   By specifying an enterpriseId, the vendor allows more specific
   parsing of the message.
####

> 
> sysUpTime again I would like specifying.  I do not think the 
> reference to
> RFC3418 enough especially as there, the syntax is TimeTicks 
> ie integer:-).  And
> since it is in hundredths of a second, is one minute 
> represented as "6000 or
> "60.00 or ...?  I assume the first is meant ie decimal 
> representation of an
> integer (which, after six months running, would be 1 576 800 
> 000 ... mmm).

I have changed the text:

####
7.3.2  sysUpTime

   The "sysUpTime" parameter MAY be used to include the SNMP "sysUpTime"
   parameter in the message.  Its syntax and semantics are as defined in
   RFC 3418 [12].

   In syslog, it is represented as a decimal string with a maximum of
   two digits for fractional seconds.  Full seconds and fractional
   seconds MUST be delimited by a period (".").  Leading zeros MUST NOT
   be used for full seconds.  For example, a "sysUpTime" of one minute
   MAY be represented as "60", "60.0", or "60.00", but not as "060" or
   "60.000".
####

I am not so proficient with SNMP, but I think (as you said) TimeTicks is
actually integer. So we should have a maximum value defined plus a
rollover behaviour. Or does this mean we also need to include an epoch?
;)

Rainer
_______________________________________________
Syslog-sec mailing list
Syslog-sec@www.employees.org
http://www.employees.org/mailman/listinfo/syslog-sec