Re: Netconf Event Message as Working Group Document

[Phil Shafer <phil@juniper.net>]

Andy Bierman writes:
>Anyone one the list with an opinion, please speak up!

Hey, that's me!! ;^)

I do feel that we need more than syslog.  In particular, I want
to be able to say "give me all the events from the last 20 minutes
that relate to interface fe-1/2/3.0".  So I need to be able to
ship specific fields in addition to the message text.  Consider:

    <notification>
      <time seconds=234532455432345>Oct 18 16:01:37</time>
      <tag>RPD_RSVP_NBRUP</tag>
      <hostname>farmer-john</hostname>
      <process pid=2958>rpd</process>
      <data>
        <neighbor>10.5.14.2</neighbor>
        <interface>fe-1/3/0.0</interface>
      </data>
      <message>RSVP neighbor 10.5.14.2 up on interface fe-1/3/0.0</message>
    </notification>

Yes, I hear you gag on the obnoxious verbosity compared with the
traditional syslog line:

Oct 18 16:01:37  farmer-john rpd[2958]: RPD_RSVP_NBRUP: RSVP neighbor 10.5.14.2 up on interface fe-1/3/0.0

And yes, I will be trafficing and storing these messages _far_ more than
I'll be searching them, so the wasted bandwidth and storage _does_ matter.

The bit of functionality I do want is being able to say:

    notification[starts-with(data/interface, $device)]

and get better results than "grep $device /var/log/messages".

The new XML-ified syslog formats don't give me any of the above.
They only put the message text in a xml element.  I still haven't
read the netconf-event spec, but skimming it, I don't see much about
real data content.

I do see the "rpc-one-way" which seems wildly confusing, as it's
not an RPC at all.  It's an async message from the server to the
client, where an RPC is a remote procedure call from the client to
the server.

Anyway, the question to me is how can I break out my individual
fields (the data I care most about) without making 400 byte messages?
I don't think the answer is XML or ASN.1, or YAML.  But some simple
ascii field encoding that will support later operations that are
rare, complex, and must be accurate.

Thanks,
 Phil

--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>