Hi, In my latest review of syslog-mib-11, I have started to believe that Tom was right when he questioned the MIB module design, which models multiple syslog entities in a table, so one SNMP engine deals with multiple syslog senders, relays, and/or recievers on the same host.
This adds complexity in the MIB design that I am not convinced is necessary. As the terminology in the MIB document has gotten closer to other WG documents, this has become somewhat clearer to me. Tom recommended that the MIB module only model a single syslog entity. Different instantations of the MIB module can be represented as existing in different contexts (e.g. in different communities), so one SNMP engine can still deal with multiple syslog senders, relays, and/or receivers on the same host, but the MIB module itself becomes simpler. We should be sure the MIB module reflects real world requirements. I do not have much operational experience, so I need your input. In real deployments, is it **typical** to have multiple syslog stacks running on the same host, each with a different bind address and port number and config file? or is it more common for most applications to share one syslog process (e.g., daemon) that operates via one address/port? David Harrington [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] _______________________________________________ Syslog mailing list [email protected] https://www1.ietf.org/mailman/listinfo/syslog
