Subject: Re: [netmod] WG Last Call for draft-ietf-netmod-syslog-model-11

From: [email-masked] (Dale R. Worley)
Date: Mon, 06 Mar 2017 15:53:56 -0500

(We seem to be well beyond the original LC date, but this is only an
editorial comment...)

The algorithm in section 3 isn't clear to me (possibly because I'm not
very familiar with syslog in practice):

   Selector processing (input is syslog message):

       1. Loop through facility-list
          a. Facility match processing - continue to the next entry in
             the list if no match
          b. Severity compare processing - continue to the next list
             entry if no match
          c. Match - proceed with the action and exit further processing
       2. Process pattern match if specified and if a match proceed with
          the action

If I understand correctly, a message is processed if it matches any one
element of facility-list OR the regexp.  In that case, I think you could
it clearer by writing the pseudocode in a style that is more functional
than imperative:

   A syslog message is processed if
       there is an element of facility-list (F, S) where
           the message facility matches F (if it is present)
	   and the message severity matches S (if it is present)
       or the message text matches the pattern (if it is present)

Dale

---

From: "Clyde Wildes (cwildes)" <[email-masked]>
Date: Mon, 13 Mar 2017 18:21:52 +0000

Dale,

Thanks for the simplification. I have incorporated this in the next draft-ietf-netmod-syslog-model revision.

Regards,

Clyde

On 3/6/17, 12:53 PM, "Dale R. Worley" <[email-masked]> wrote:

    

    
    
    Dale

---

From: [email-masked] (Dale R. Worley)
Date: Tue, 14 Mar 2017 20:06:02 -0400

> draft-ietf-netmod-syslog-model revision.

Ah, thanks!

Looking at -13, I see this:

   A syslog message is processed if:

       There is an element of facility-list (F, S) where
           the message facility matches F (if it is present)
              and the message severity matches S (if it is present)
       or the message text matches the regex pattern (if it is present)

I think you want to move the line "and the message severity ..." to the
left by two spaces so that the lines are aligned by how they are grouped
by the logical operators.  That would give:

       There is an element of facility-list (F, S) where
           the message facility matches F (if it is present)
           and the message severity matches S (if it is present)
       or the message text matches the regex pattern (if it is present)

Dale