Thanks, all, for the useful comments about this document. It seems clear that there is support for developing this work and producing a data model for monitoring.
Two points: 1. As noted by Sue, there is a BoF/WG planned for IETF-98 on "Security Events". I suggest you go to that. I will also make sure the AD is aware of the potential overlap/interaction. 2. It seems reasonable to me that producing an information model (such as in draft-zhang-i2nsf-info-model-monitoring) is a useful step toward producing a data model. I have no objection to using a structured approach. However, my question about "publication" could be phrased as follows: - Suppose we decide we want a data model for monitoring - Suppose we use draft-zhang-i2nsf-info-model-monitoring to guide our work on that data model - Suppose that we push ahead with the data model quite soon so that it starts to catch up with the info model If all of those things apply, why would we need to publish an RFC that captures the information model given that we will be publishing a data model shortly afterwards? Presumably, once the data model is published, no one will ever read the information model. So the information model would be a valuable document working document in which the WG would capture its thoughts and consensus, but would be discarded once the work to make the data model was complete. Or am I wrong? Thanks, Adrian > -----Original Message----- > From: Susan Hares [mailto:sha...@ndzh.com] > Sent: 13 October 2016 14:49 > To: adr...@olddog.co.uk; email@example.com > Subject: RE: [I2nsf] Thoughts on draft-zhang-i2nsf-info-model-monitoring > > Adrian: > > Why: Monitoring is a key component to I2NSF for monitoring NSF devices. > Monitoring is not the same as NSF devices sending notifications - which is a > push from the NSF devices. Monitoring may encompasses specific requests to > the device. Monitoring is different than the DOTS - "help me" cry from a > device under attack. > While I see the security ADs are proposing Security event, it is important > that the I2NSF create monitoring concepts that work with all of the > functions (e.g. querying capabilities, sending/receiving notification, and > events). > > Data model versus Information model: Since we do not seem to have a clear > idea of what the data model should be, it is important to create the > informational models. > > The content of the draft is a good first step. > > Sue Hares > > > > -----Original Message----- > From: I2nsf [mailto:i2nsf-boun...@ietf.org] On Behalf Of Adrian Farrel > Sent: Tuesday, October 11, 2016 5:22 PM > To: firstname.lastname@example.org > Subject: [I2nsf] Thoughts on draft-zhang-i2nsf-info-model-monitoring > > Working Group, > > Linda and I would like to hear some more from you about > draft-zhang-i2nsf-info-model-monitoring. > > Is it something you think we should be working on? > Should we have a separate YANG module for it or fold it into other modules? > If we produce a YANG module, do we still need to publish the information > model? > > And, most important, what do you think of the content of the draft? > > Thanks, > Adrian > > _______________________________________________ > I2nsf mailing list > I2nsf@ietf.org > https://www.ietf.org/mailman/listinfo/i2nsf _______________________________________________ I2nsf mailing list I2nsf@ietf.org https://www.ietf.org/mailman/listinfo/i2nsf