Re: Syslog-sign: Configuration parameters

Hi Pasi,

All of this looks good to me.  I believe that Alex will be able to get a 
new ID out next week.

Best regards,
Chris

On Thu, 19 Feb 2009, [email protected] wrote:

> Chris Lonvick wrote:
>
>> It needs to be "Resend" as these are redundant.  Let me give
>> a very simple case to show:
>> If we configure the sender to have:
>> - a Signature Block Count (CNT) of 50
>> - sigRepeat=2
>> - sigResendDelay=30sec
>> - sigResendCount=34
>> then:
>>      time      Sender                   Collector
>>      0s          ---syslog messages 1-50--->
>>      14s         ---sig block for msgs 1-50--->
>>      44s         ---syslog messages 51-60--->
>>      44s         ---sig block for msgs 1-50---> (R1,1)
>>      52s         ---syslog messages 61-95--->
>>      52s         ---sig block for msgs 1-50---> (R1,2)
>>      60s         ---syslog messages 95-100--->
>>      60s         ---sig block for msgs 51-100--->
>>
>>
>> For the first 14 seconds, the device sends 50 messages and then the
>> Signature Block for them.  Thirty seconds later, the sigResendDelay
>> timer trips to send the first redundant Signature Block of the first
>> 50 messages - shown as (R1,1).  Eight seconds after that, the sender
>> sees that it has sent 34 messages since sending out the previous
>> redundant Signature Block so it sends out the second redundant
>> Signature Block of the first 50 messages - shown as (R1,2).
>
> Thanks for the explanation -- I think I now understood this!
>
>> I do take your point that there is nothing to kick out the initial
>> signature block on a slow system.  Same example:
>>      time      Sender                   Collector
>>      0s          ---syslog messages 1-47--->
>>      ...eight years later, still nothing else...
>>
>> So there should be a sigMaxInterval.
>>
>> I would rewrite it as follows:
>> ===
>> 6.1.2.  Configuration Parameters for Signature Blocks
>>
>
> Perhaps we should deal with non-redundant signature blocks first,
> and retransmissions afterward? How about:
>
>   The following parameters control how often Signature Blocks are
>   generated (note that the maximum message length may also force
>   generating a Signature Block; see Sections 4.2.6 and 4.2.7):
>
>   sigMaxInterval = generate a new Signature Block if this many seconds
>   have elapsed since the previous new Signature Block (not counting
>   retransmissions). Note that this applies even when no other syslog
>   messages have been sent since the previous Signature Block.
>
>   sigMaxCount = generate a Signature Block if this many other syslog
>   messages have been sent since the previous new Signature Block
>   (not counting retransmissions).
>
> (Changed "send" to "generate" here)
>
>>    To ensure reliably delivery (see Section 8.5), it is useful to send
>>    the same Signature Block multiple times. This is controlled by the
>>    "sigRepeat" parameter:
>>
>>      sigRepeat = number of times a Signature Block is resent.
>>      It is RECOMMENDED to use a value greater than 0 in particular
>>      when the UDP transport [RFC5426] is used.
>>
>>    The following parameters control how often the redundant Signature
>>    Blocks are sent.
>
> How about:
>
>   The retransmitted Signature Blocks are not sent immediately after
>   the original transmission, but slightly later. The following
>   parameters control when the retransmissions are done (note that
>   these are independent of the parameters controlling when new
>   Signature Blocks are generated):
>
>>     sigResendDelay = send a redundant Signature Block if this many
>>     seconds have elapsed since sending the original Signature
>>     Block, or any previous redundant Signature Blocks.
>
> How about:
>
>   sigResendDelay = retransmit if this many seconds have elapsed
>   since the previous sending of this Signature Block.
>
> ("any" could refer to any Signature Block, even a new one.)
>
>>      sigResendCount = send a Signature Block if this many other
>>      syslog messages have been sent since sending the original
>>      Signature Block, or any previous redundant Signature Blocks.
>
> How about:
>
>   sigResendCount = retransmit if this many other syslog messages have
>   been sent since the previous sending of this Signature Block.
>
> Best regards,
> Pasi
>
_______________________________________________
Syslog mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/syslog