[Syslog] Facilities - normative or informative label

[Chris Lonvick <clonvick at cisco.com>]

Hi Folks,

This is adding to the note that David sent out about syslog-tc-mib-02 and 
a discussion we've had about the Facilities.  David and I have reviewed 
the mailing list discussion and have concluded that the labels are 
normative, but irrelevant.

For interoperability and backwards compatibility reasons, the values and 
labels are normative, so the mapping from a label configured by operators 
in syslog.conf or equivalent consistently maps to the same Facility number 
regardless of implementation, but the label itself is often semantically 
meaningless, because there are not enough numbers to cover all possible 
facilities, and the enumeration (label and value) that is used by an 
actual facility is, and has historically been, implementation-dependent.

For example, the foobar application might log messages as having come from 
local7, even though there is no "local" process on the device, and the 
operator can configure syslog.conf to have local7.critical messages be 
relayed, even though there might be multiple facilities using Facility 
local7.  This is typical current practice, and originators, relays and 
collectors know how to handle this situation.  For improved accuracy, the 
foobar application can also include an APPNAME SDE in the message 
identifying itself as the "foobar" application."

Also, I believe it is the intent of the WG that _all_ processes have the 
ability to use the syslog transport to send their messages to a device 
that might care.  My concern is that we'll never have enough Facilities to 
distincly identify all possible processes that might want to send 
messages.  I think that we had a discussion a long time ago about trying 
to associate a number with each process, with enough expansion to cover 
the future.  It didn't work out then and it won't work now.

Another way to say what I'm thinking is that that some policy may be 
enacted at my company to say that my foo.log or my virusscan.log (as 
examples) be forwarded from my machine to some central repository. 
Neither of these things are going to be able to use a defined Facility but 
they could both use local7 simultaneously.  Some process at the receiver 
would have to separate them based upon APPNAME.

_______________________________________________
Syslog mailing list
Syslog at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/syslog