A YANG Data Model for Syslog
ConfigurationCisco Systems Inc.170 West Tasman DriveSan JoseCA95134US+1 408 527-2672cwildes@cisco.comVerizon Wireless500 W Dove Rd.SouthlakeTX76092US+1 512 650-0210kirankoushik.agraharasreenivasa@verizonwireless.com
General
NETMOD WGThis document defines a YANG data model for the configuration of a
syslog process. It is intended this model be used by vendors who
implement syslog in their systems.This draft contains many placeholder values that need to be replaced
with finalized values at the time of publication. This note summarizes
all of the substitutions that are needed. No other RFC Editor
instructions are specified elsewhere in this document.Artwork in this document contains shorthand references to drafts in
progress. Please apply the following replacements: xxxx --> the assigned RFC value
for draft-ietf-netconf-keystoreyyyy --> the assigned RFC value
for draft-ietf-netconf-tls-client-serverzzzz --> the assigned RFC value
for this draftOperating systems, processes and applications generate messages
indicating their own status or the occurrence of events. These messages
are useful for managing and/or debugging the network and its services.
The BSD syslog protocol is a widely adopted protocol that is used for
transmission and processing of the message.Since each process, application and operating system was written
somewhat independently, there is little uniformity to the content of
syslog messages. For this reason, no assumption is made upon the
formatting or contents of the messages. The protocol is simply designed
to transport these event messages. No acknowledgement of the receipt is
made.Essentially, a syslog process receives messages (from the kernel,
processes, applications or other syslog processes) and processes them.
The processing may involve logging to a local file, and/or displaying on
console, and/or relaying to syslog processes on other machines. The
processing is determined by the "facility" that originated the message
and the "severity" assigned to the message by the facility.We are using definitions of syslog protocol from in this RFC.The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in and .The term "originator" is defined in : an
"originator" generates syslog content to be carried in a message.The term "relay" is defined in : a "relay"
forwards messages, accepting messages from originators or other relays
and sending them to collectors or other relaysThe term "collectors" is defined in : a
"collector" gathers syslog content for further analysis.The term "action" refers to the processing that takes place for
each syslog message received.A simplified graphical representation of the data models is used in
this document. The meaning of the symbols in these diagrams is as
follows:Brackets "[" and "]" enclose list keys.Braces "{" and "}" enclose feature names, and indicate that the
named feature must be present for the subtree to be
present.Abbreviations before data node names: "rw" means configuration
(read-write) and "ro" state data (read-only).Symbols after data node names: "?" means an optional node, "!"
means a presence container, and "*" denotes a list and
leaf-list.Parentheses enclose choice and case nodes, and case nodes are
also marked with a colon (":").Ellipsis ("...") stands for contents of subtrees that are not
shown.This document defines a YANG configuration
data model that may be used to configure the syslog feature running on a
system. YANG models can be used with network management protocols such
as NETCONF to install, manipulate, and delete
the configuration of network devices.The data model makes use of the YANG "feature" construct which allows
implementations to support only those syslog features that lie within
their capabilities.This module can be used to configure the syslog application
conceptual layers as implemented on the target system.The syslog model was designed by comparing various syslog features
implemented by various vendors' in different implementations.This draft addresses the common leafs between implementations and
creates a common model, which can be augmented with proprietary
features, if necessary. This model is designed to be very simple for
maximum flexibility.Some optional features are defined in this document to specify
functionality that is present in specific vendor configurations.Syslog consists of originators and collectors. The following diagram
shows syslog messages flowing from an originator, to collectors where
filtering can take place.Collectors are configured using the leaves in the syslog model
"actions" container which correspond to each message collector:consolelog file(s)remote relay(s)/collector(s)Within each action, a selector is used to filter syslog messages. A
selector consists of a list of one or more facility-severity matches,
and, if supported via the select-match feature, an optional regular
expression pattern match that is performed on the field.A syslog message is processed if: The facility is one of a specific syslog-facility, or all
facilities.The severity is one of type syslog-severity, all severities, or none.
None is a special case that can be used to disable a filter. When
filtering severity, the default comparison is that messages of the
specified severity and higher are selected to be logged. This is shown
in the model as "default equals-or-higher". This behavior can be altered
if the select-adv-compare feature is enabled to specify a compare
operation and an action. Compare operations are: "equals" to select
messages with this single severity, or "equals-or-higher" to select
messages of the specified severity and higher. Actions are used to log
the message or block the message from being logged.Many vendors extend the list of facilities available for logging in
their implementation. An example is included in Extending Facilities
(Appendix A.1).A simplified graphical representation of the data model is used in
this document. Please see Section 1.3 for tree diagram notation.This module imports typedefs from [RFC6021], [RFC7223], groupings
from [RFC yyyy], and [RFC xxxx],
and it references [RFC5424],
[RFC5425],
[RFC5426],
[RFC6587],
and [RFC5848].The authors wish to thank the following who commented on this
proposal:Andy BiermanMartin BjorklundAlex CampbellAlex ClemmJim GibsonJeffrey HaasJohn HeasleyGiles HeronLisa HuangMahesh JethanandaniJeffrey K LangeJan LindbladChris LonvickTom PetchJuergen SchoenwaelderPhil ShaferJason SternePeter Van HorneKent WatsenBert WijnenDale R WorleyAleksandr ZhdankinThis document registers one URI in the IETF XML registry . Following the format in ,
the following registration is requested:This document registers one YANG module in the YANG Module Names
registry />. Following the format in />, the the following registration is
requested:The YANG module defined in this document is designed to be accessed
via YANG based management protocols, such as NETCONF and RESTCONF . Both of these
protocols have mandatory-to- implement secure transport layers (e.g.,
SSH, TLS) with mutual authentication.The NETCONF access control model (NACM)
provides the means to restrict access for particular users to a
pre-configured subset of all available protocol operations and
content.There are a number of data nodes defined in this YANG module that are
writable/creatable/deletable (i.e., config true, which is the default).
These data nodes may be considered sensitive or vulnerable in some
network environments. Write operations (e.g., edit-config) to these data
nodes without proper protection can have a negative effect on network
operations.It is the responsibility of the network administrator to ensure
that the configured message flow does not overwhelm system
resources.Network administrators must take the time to estimate the
appropriate storage capacity caused by the configuration of
actions/file using file-archive attributes to limit storage used.It is the responsibility of the network administrator to ensure
that the messages are actually going to the intended recipients."Chapter 9: Regular Expressions". The Open Group Base
Specifications Issue 6, IEEE Std 1003.1-2008, 2016 Edition.The Open GroupMany vendors extend the list of facilities available for logging in
their implementation. Additional facilities may not work with the
syslog protocol as defined in [RFC5424] and hence such facilities
apply for local syslog-like logging functionality.The following is an example that shows how additional facilities
could be added to the list of available facilities (in this example
two facilities are added):