On Wed, Nov 12, 2014 at 07:48:19AM -1000, Olafur Gudmundsson wrote: > Thus I would say the usage case is “a log processing tool MAY do PTR lookups”
There's no reason to suppose that the name a source has at the time you look at the log is the one that it had when it performed the action. I think doing PTR lookups when processing logs is just a way to introduce errors (just as doing PTR lookups when creating the log entry is a way to introduce system overhead and delays). If we're going to go through all of this again, I really do urge people to look at the list archives from 2006-2008. We went through a lot about these use cases then. You can reach back further if you like -- the draft's filename once contained the word "required", which is I suspect part of what hurt it so much. Best regards, A -- Andrew Sullivan [email protected] _______________________________________________ DNSOP mailing list [email protected] https://www.ietf.org/mailman/listinfo/dnsop
