A YANG Data Model for Syslog
ConfigurationCisco Systems Inc.170 West Tasman DriveSan JoseCA95134US+1 408 527-2672cwildes@cisco.comVerizon Wireless500 W Dove Rd.SouthlakeTX76092US+1 512 650-0210kirankoushik.agraharasreenivasa@verizonwireless.com
General
NETMOD WGThis document defines a YANG data model for the configuration of a
syslog process. It is intended this model be used by vendors who
implement syslog in their systems.The YANG model in this document conforms to the Network Management
Datastore Architecture defined in
[draft-ietf-netmod-revised-datastores].Operating systems, processes and applications generate messages
indicating their own status or the occurrence of events. These messages
are useful for managing and/or debugging the network and its services.
The BSD syslog protocol is a widely adopted protocol that is used for
transmission and processing of the message.Since each process, application and operating system was written
somewhat independently, there is little uniformity to the content of
syslog messages. For this reason, no assumption is made upon the
formatting or contents of the messages. The protocol is simply designed
to transport these event messages. No acknowledgement of the receipt is
made.Essentially, a syslog process receives messages (from the kernel,
processes, applications or other syslog processes) and processes them.
The processing may involve logging to a local file, and/or displaying on
console, and/or relaying to syslog processes on other machines. The
processing is determined by the "facility" that originated the message
and the "severity" assigned to the message by the facility.We are using definitions of syslog protocol from in this RFC.The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 when, and only
when, they appear in all capitals, as shown here.The term "originator" is defined in : an
"originator" generates syslog content to be carried in a message.The term "relay" is defined in : a "relay"
forwards messages, accepting messages from originators or other relays
and sending them to collectors or other relaysThe term "collectors" is defined in : a
"collector" gathers syslog content for further analysis.The term "action" refers to the processing that takes place for
each syslog message received.The YANG model in this document conforms to the Network Management
Datastore Architecture defined in I-D.ietf-netmod-revised-datastores.This document contains many placeholder values that need to be
replaced with finalized values at the time of publication. This note
summarizes all of the substitutions that are needed. No other RFC
Editor instructions are specified elsewhere in this document.Artwork in this document contains shorthand references to drafts in
progress. Please apply the following replacements: I-D.ietf-netconf-keystore -->
the assigned RFC value for draft-ietf-netconf-keystoreI-D.ietf-netconf-tls-client-server
--> the assigned RFC value for
draft-ietf-netconf-tls-client-serverzzzz --> the assigned RFC value
for this draftdraft-ietf-netmod-revised-datastores --> the assigned RFC
value for I-D.ietf-netmod-revised-datastoresThis document defines a YANG configuration
data model that may be used to configure the syslog feature running on a
system. YANG models can be used with network management protocols such
as NETCONF to install, manipulate, and delete
the configuration of network devices.The data model makes use of the YANG "feature" construct which allows
implementations to support only those syslog features that lie within
their capabilities.This module can be used to configure the syslog application
conceptual layers as implemented on the target system.The syslog model was designed by comparing various syslog features
implemented by various vendors' in different implementations.This document addresses the common leafs between implementations and
creates a common model, which can be augmented with proprietary
features, if necessary. This model is designed to be very simple for
maximum flexibility.Some optional features are defined in this document to specify
functionality that is present in specific vendor configurations.Syslog consists of originators and collectors. The following diagram
shows syslog messages flowing from originators, to collectors where
filtering can take place.Collectors are configured using the leaves in the syslog model
"actions" container which correspond to each message collector:consolelog file(s)remote relay(s)/collector(s)Within each action, a selector is used to filter syslog messages. A
selector consists of a list of one or more facility-severity matches,
and, if supported via the select-match feature, an optional regular
expression pattern match that is performed on the field.A syslog message is processed if: The facility is one of a specific syslog-facility, or all
facilities.The severity is one of type syslog-severity, all severities, or none.
None is a special case that can be used to disable a filter. When
filtering severity, the default comparison is that messages of the
specified severity and higher are selected to be logged. This is shown
in the model as "default equals-or-higher". This behavior can be altered
if the select-adv-compare feature is enabled to specify a compare
operation and an action. Compare operations are: "equals" to select
messages with this single severity, or "equals-or-higher" to select
messages of the specified severity and higher. Actions are used to log
the message or block the message from being logged.Many vendors extend the list of facilities available for logging in
their implementation. An example is included in Extending Facilities
(Appendix A.1).A simplified graphical representation of the data model is used in
this document. Please see [I-D.ietf-netmod-yang-tree-diagrams] for
tree diagram notation.This module imports typedefs from ,
groupings from , and , and it references , , , and and .The authors wish to thank the following who commented on this
proposal:Andy Bierman, Martin Bjorklund, Alex Campbell, Alex Clemm, Jim
Gibson, Jeffrey Haas, John Heasley, Giles Heron, Lisa Huang, Mahesh
Jethanandani, Jeffrey K Lange, Jan Lindblad, Chris Lonvick, Tom Petch,
Juergen Schoenwaelder, Phil Shafer, Yaron Sheffer, Jason Sterne, Peter
Van Horne, Kent Watsen, Bert Wijnen, Dale R Worley, Aleksandr
ZhdankinThis document registers one URI in the IETF XML registry . Following the format in ,
the following registration is requested:This document registers one YANG module in the YANG Module Names
registry . Following the format in , the following registration is requested:The YANG module defined in this document is designed to be accessed
via YANG based management protocols, such as NETCONF and RESTCONF . Both of these
protocols have mandatory-to-implement secure transport layers (e.g.,
SSH, TLS) with mutual authentication.The NETCONF access control model (NACM)
provides the means to restrict access for particular users to a
pre-configured subset of all available protocol operations and
content.There are a number of data nodes defined in this YANG module that are
writable/creatable/deletable (i.e., config true, which is the default).
These data nodes should be considered sensitive or vulnerable in all
network environments. Write operations (e.g., edit-config) to these data
nodes without proper protection can have a negative effect on network
operations and on network security.In addition there are data nodes that require careful analysis and
review. These are the subtrees and data nodes and their
sensitivity/vulnerability: When writing this
node, implementations MUST ensure that the regular expression
pattern match is not constructed to cause a regular expression
denial of service attack due to a pattern that causes the regular
expression implementation to work very slowly (exponentially related
to input size).When
writing this subtree, implementations MUST NOT specify a private key
that is used for any other purpose.Some of the readable data nodes in this YANG module may be considered
sensitive or vulnerable in some network environments. It is thus
important to control read access (e.g., via get, get-config, or
notification) to these data nodes. These are the subtrees and data nodes
and their sensitivity/vulnerability: This subtree contains
information about other hosts in the network, and the TLS transport
certificate properties if TLS is selected as the transport
protocol.This subtree contains
information about the syslog message signing properties including
signing certificate information.There are no RPC operations defined in this YANG module."Chapter 9: Regular Expressions". The Open Group Base
Specifications Issue 6, IEEE Std 1003.1-2008, 2016 Edition.The Open GroupMany vendors extend the list of facilities available for logging in
their implementation. Additional facilities may not work with the
syslog protocol as defined in [RFC5424] and hence such facilities
apply for local syslog-like logging functionality.The following is an example that shows how additional facilities
could be added to the list of available facilities (in this example
two facilities are added):