Re: Management Requirements

On Tue, Aug 07, 2012 at 11:01:37PM +0200, Romascanu, Dan (Dan) wrote:
> 
> [[DR]] I agree with all the analysis made by Juergen, maybe with one
> reservation: 
> 
> > SNMP notifications means one SNMP message per event and the same
> > holds true for SYSLOG; IPFIX allows to send a collection of events in
> > one IPFIX message and hence it might be more scalable, which might be
> > important for some NAT deployments.
> 
> You can actually send more than one SNMP message per event if you define
> the notifications accordingly, so I say that this really depends upon
> modeling. On the other hand if 'real-time'-liness is a requirement -
> a.k.a as soon as certain events happen you _may_ have an advantage with
> SNMP notifications. 

I have not been considering the case of M>1 messages per event.

I was writing about the case of E>1 events per message. SNMP limits
things to at best to one event per message. IPFIX seems to be able to
batch several events into a single IPFIX message. Of course, there are
other considerations here, the congestion control of the underlying
transport and whether a high-level of event notifications are needed
in the first place. Since this comes up in BEHAVE context, there might
be legal requirements (in some legislations) to do full session
logging of so called carrier grade NATs.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>