rfc9742.original   rfc9742.txt 
NETMOD WG J. Clarke, Ed. Internet Engineering Task Force (IETF) J. Clarke, Ed.
Internet-Draft Cisco Request for Comments: 9742 Cisco
Intended status: Standards Track M. Jethanandani, Ed. Category: Standards Track M. Jethanandani, Ed.
Expires: 22 March 2025 Kloud Services ISSN: 2070-1721 Kloud Services
C. Wildes, Ed. C. Wildes, Ed.
Cisco Systems Inc. Cisco Systems Inc.
K. Koushik, Ed. K. Koushik, Ed.
Verizon Wireless Verizon Wireless
18 September 2024 April 2025
A YANG Data Model for Syslog Configuration A YANG Data Model for Syslog Management
draft-ietf-netmod-syslog-model-33
Abstract Abstract
This document defines a YANG data model for the configuration of a This document defines a YANG data model for the management of a
syslog process. It is intended that this model be used by vendors syslog process. It is intended that this data model be used by
who implement syslog collectors in their systems. vendors who implement syslog collectors in their systems.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This is an Internet Standards Track document.
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months This document is a product of the Internet Engineering Task Force
and may be updated, replaced, or obsoleted by other documents at any (IETF). It represents the consensus of the IETF community. It has
time. It is inappropriate to use Internet-Drafts as reference received public review and has been approved for publication by the
material or to cite them other than as "work in progress." Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 7841.
This Internet-Draft will expire on 22 March 2025. Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
https://www.rfc-editor.org/info/rfc9742.
Copyright Notice Copyright Notice
Copyright (c) 2024 IETF Trust and the persons identified as the Copyright (c) 2025 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/ Provisions Relating to IETF Documents
license-info) in effect on the date of publication of this document. (https://trustee.ietf.org/license-info) in effect on the date of
Please review these documents carefully, as they describe your rights publication of this document. Please review these documents
and restrictions with respect to this document. Code Components carefully, as they describe your rights and restrictions with respect
extracted from this document must include Revised BSD License text as to this document. Code Components extracted from this document must
described in Section 4.e of the Trust Legal Provisions and are include Revised BSD License text as described in Section 4.e of the
provided without warranty as described in the Revised BSD License. Trust Legal Provisions and are provided without warranty as described
in the Revised BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 1.1. Requirements Language
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Terminology
3. NMDA Compliance . . . . . . . . . . . . . . . . . . . . . . . 4 3. NMDA Compliance
4. Editorial Note (To be removed by RFC Editor) . . . . . . . . 4 4. Design of the Syslog Model
5. Design of the Syslog Model . . . . . . . . . . . . . . . . . 4 4.1. Syslog Module
5.1. Syslog Module . . . . . . . . . . . . . . . . . . . . . . 6 5. Syslog YANG Module
6. Syslog YANG Module . . . . . . . . . . . . . . . . . . . . . 9 5.1. The ietf-syslog Module
6.1. The ietf-syslog Module . . . . . . . . . . . . . . . . . 9 6. Usage Examples
7. Usage Examples . . . . . . . . . . . . . . . . . . . . . . . 29 6.1. Syslog Configuration for Severity Critical
7.1. Syslog Configuration for Severity Critical . . . . . . . 29 6.2. Remote Syslog Configuration
7.2. Remote Syslog Configuration . . . . . . . . . . . . . . . 30 7. IANA Considerations
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 31 7.1. The IETF XML Registry
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 31 7.2. The YANG Module Names Registry
9.1. The IETF XML Registry . . . . . . . . . . . . . . . . . . 32 8. Security Considerations
9.2. The YANG Module Names Registry . . . . . . . . . . . . . 32 9. References
10. Security Considerations . . . . . . . . . . . . . . . . . . . 32 9.1. Normative References
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 33 9.2. Informative References
11.1. Normative References . . . . . . . . . . . . . . . . . . 33 Appendix A. Tree Diagrams
11.2. Informative References . . . . . . . . . . . . . . . . . 36 A.1. Complete Tree Diagram
Appendix A. Tree Diagrams . . . . . . . . . . . . . . . . . . . 36 Appendix B. Implementer Guidelines
A.1. Complete Tree Diagram . . . . . . . . . . . . . . . . . . 36 B.1. Extending Facilities
Appendix B. Implementer Guidelines . . . . . . . . . . . . . . . 48 B.2. Syslog Terminal Output
B.1. Extending Facilities . . . . . . . . . . . . . . . . . . 48 B.3. Syslog File Naming Convention
B.2. Syslog Terminal Output . . . . . . . . . . . . . . . . . 49 Acknowledgements
B.3. Syslog File Naming Convention . . . . . . . . . . . . . . 50 Authors' Addresses
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 50
1. Introduction 1. Introduction
This document defines a YANG [RFC7950] configuration data model that This document defines a YANG [RFC7950] data model that may be used to
may be used to configure the syslog feature running on a system. configure the syslog feature running on a system. YANG data models
YANG models can be used with network management protocols such as can be used with network management protocols such as NETCONF
NETCONF [RFC6241] to install, manipulate, and delete the [RFC6241] to install, manipulate, and delete the configuration of
configuration of network devices. network devices.
The data model makes use of the YANG "feature" construct which allows The data model makes use of the YANG "feature" construct that allows
implementations to support only those syslog features that lie within implementations to support only those syslog features that lie within
their capabilities. their capabilities.
This module can be used to configure the syslog application This module can be used to configure the syslog application
conceptual layers as implemented on the syslog collector. conceptual layers as implemented on the syslog collector.
Essentially, a syslog process receives messages (from the kernel, Essentially, a syslog process receives messages (from the kernel,
processes, applications or other syslog processes) and processes processes, applications, or other syslog processes) and processes
them. The processing may involve logging to a local file, and/or them. The processing may involve logging to a local file, displaying
displaying on console, and/or relaying to syslog processes on other on console, and/or relaying to syslog processes on other machines.
machines. The processing is determined by the "facility" that The process is determined by the "facility" that originated the
originated the message and the "severity" assigned to the message by message and the "severity" assigned to the message by the facility.
the facility.
Such definitions of syslog protocol are defined in [RFC5424] , and Such definitions of syslog protocol are defined in [RFC5424] and are
are used in this RFC. used in this RFC.
The YANG model in this document conforms to the Network Management The YANG data model in this document conforms to the Network
Datastore Architecture defined in [RFC8342]. Management Datastore Architecture defined in [RFC8342].
1.1. Requirements Language 1.1. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP "OPTIONAL" in this document are to be interpreted as described in
14 [RFC2119] [RFC8174] when, and only when, they appear in all BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here. capitals, as shown here.
2. Terminology 2. Terminology
The following terms are used throughout this document: The following terms are used throughout this document:
* Originator: an "originator" refers to an entity that generates Originator: An "originator" refers to an entity that generates
syslog content to be carried in a message. The term is defined in syslog content to be carried in a message. The term is defined in
[RFC5424] [RFC5424].
* Relay: A "relay" is an entity that forwards syslog messages. It Relay: A "relay" is an entity that forwards syslog messages. It
accepts messages from originators or other relays and sends them accepts messages from originators or other relays and sends them
to collectors or other relays. The term is defined in [RFC5424] to collectors or other relays. The term is defined in [RFC5424].
* Collector: A "collector" gathers syslog content for further Collector: A "collector" gathers syslog content for further
analysis. The term is defined in [RFC5424]. analysis. The term is defined in [RFC5424].
* Action: The term "action" refers to the processing that takes Action: The term "action" refers to the process that takes place for
place for each syslog message received. each syslog message received.
3. NMDA Compliance 3. NMDA Compliance
The YANG model in this document conforms to the Network Management The YANG data model in this document conforms to the Network
Datastore Architecture defined in [RFC8342] . Management Datastore Architecture (NMDA) defined in [RFC8342].
4. Editorial Note (To be removed by RFC Editor)
This document contains many placeholder values that need to be
replaced with finalized values at the time of publication. This note
summarizes all of the substitutions that are needed. No other RFC
Editor instructions are specified elsewhere in this document.
Artwork in this document contains shorthand references to drafts in
progress. Please apply the following replacements:
* I-D.ietf-netconf-crypto-types --> the assigned RFC value for
draft-ietf-netconf-crypto-types
* I-D.ietf-netconf-tls-client-server --> the assigned RFC value for
draft-ietf-netconf-tls-client-server
* zzzz --> the assigned RFC value for this draft
5. Design of the Syslog Model 4. Design of the Syslog Model
The syslog model was designed by comparing various syslog features The syslog model was designed by comparing various syslog features
implemented by various vendors' in different implementations. implemented by various vendors in different implementations.
The module defines leafs that are common across implementations. Its The module defines leafs that are common across implementations. Its
simple design is meant to offer maximum flexibility. However, not simple design is meant to offer maximum flexibility. However, not
all optional features defined in this document are present in all all optional features defined in this document are present in all
vendor implementations. Vendors therefore, need to use the feature vendor implementations. Therefore, vendors need to use the feature
statements to specify the optional features they support. At the statements to specify the optional features they support. At the
same time, vendors can augment the model to add proprietary features. same time, vendors can augment the model to add proprietary features.
Extending Facilities (Appendix B.1) shows an examples of how that can "Extending Facilities" (Appendix B.1) shows an example of how that
be realized. can be realized.
Syslog consists of originators and collectors. The following diagram Syslog consists of originators and collectors. The following diagram
shows syslog messages flowing from originators, to collectors where shows the syslog processing flow from originators to collectors where
filtering can take place. filtering can take place.
Originators Originators
+-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+
| Various | | OS | | | | Remote | | Various | | OS | | | | Remote |
| Components | | Kernel | | Line Cards | | Servers | | Components | | Kernel | | Line Cards | | Servers |
+-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+
+-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+
| SNMP | | Interface | | Standby | | Syslog | | SNMP | | Interface | | Standby | | Syslog |
| Events | | Events | | Supervisor | | Itself | | Events | | Events | | Supervisor | | Itself |
+-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+
| | | |
+----------------------------------------------------------------+ +----------------------------------------------------------------+
| |
| |
| |
| |
+-------------+--------------+ +-------------+--------------+
| | | | | |
v v v v v v
Collectors Collectors
+----------+ +----------+ +----------------+ +----------+ +----------+ +----------------+
| | | Log | |Remote Relay(s)/| | | | Log | |Remote Relay(s)/|
| Console | | File(s) | |Collector(s) | | Console | | File(s) | |Collector(s) |
+----------+ +----------+ +----------------+ +----------+ +----------+ +----------------+
Figure 1. Syslog Processing Flow Figure 1: Syslog Processing Flow
Collectors are configured using the leaves in the syslog model Collectors are configured using the leafs in the syslog model
"actions" container which correspond to each message collector: "actions" container that correspond to each message collector:
console * console
log file(s) * log file(s)
remote relay(s)/collector(s) * remote relay(s)/collector(s)
Within each action, a selector is used to filter syslog messages. A Within each action, a selector is used to filter syslog messages. A
selector consists of a list of one or more filters specified by selector consists of a list of one or more filters specified by
facility-severity pairs, and, if supported via the select-match facility-severity pairs, and, if supported via the select-match
feature, an optional regular expression pattern match that is feature, an optional regular expression pattern match that is
performed on the [RFC5424] field. performed on the MSG field described in Section 6.4 of [RFC5424].
A syslog message is processed if:
There is an element of facility-list (F, S) where A syslog message is processed if there is an element
the message facility matches F of facility-list (F, S) where
and the message severity matches S the message facility matches F,
and/or the message text matches the regex pattern (if it the message severity matches S,
is present) and/or the message text matches the regex pattern (if it
is present)
The facility is one of a specific syslog-facility, or all facilities. The facility is one of a specific syslog-facility or all facilities.
The model offers the ability to select a transport that a user might The model offers the ability to select a transport that a user might
want to use for a remote relay or collector. The choice is between want to use for a remote relay or collector. The choice is between
using UDP, or TLS based sessions. The user can configure multiple using UDP or TLS-based sessions. The user can configure multiple
relays or collectors, but they have to use the same transport. relays or collectors, but they have to use the same transport.
The severity is one of type syslog-severity, all severities, or none. The severity is one of type syslog-severity, all severities, or none.
None is a special case that can be used to disable a filter. When None is a special case that can be used to disable a filter. When
filtering severity, the default comparison is that messages of the filtering severity, the default comparison is that messages of the
specified severity and higher are selected to be logged. This is specified severity and higher are selected to be logged. This is
shown in the model as "default equals-or-higher". This behavior can shown in the model as "default equals-or-higher". This behavior can
be altered if the select-adv-compare feature is enabled to specify a be altered if the select-adv-compare feature is enabled to specify a
compare operation and an action. Compare operations are: "equals" to compare operation and an action. Compare operations are: "equals" to
select messages with this single severity, or "equals-or-higher" to select messages with this single severity, or "equals-or-higher" to
select messages of the specified severity and higher. Actions are select messages of the specified severity and higher. Actions are
used to log the message, block the message, or stop the message from used to log the message, block the message, or stop the message from
being logged. being logged.
Many vendors extend the list of facilities available for logging in Many vendors extend the list of facilities available for logging in
their implementation. An example is included in Extending Facilities their implementation. An example is included in "Extending
(Appendix B.1). Facilities" (Appendix B.1).
5.1. Syslog Module 4.1. Syslog Module
A simplified tree representation of the data model is used in this A simplified tree representation of the data model is shown in
document. Please see [RFC8340] for tree diagram notation. Figure 2. Please see [RFC8340] for tree diagram notation.
module: ietf-syslog module: ietf-syslog
+--rw syslog! +--rw syslog!
+--rw actions +--rw actions
+--rw console! {console-action}? +--rw console! {console-action}?
| +--rw filter | +--rw filter
| | +--rw facility-list* [facility severity] | | +--rw facility-list* [facility severity]
| | +--rw facility union | | +--rw facility union
| | +--rw severity union | | +--rw severity union
| | +--rw advanced-compare {select-adv-compare}? | | +--rw advanced-compare {select-adv-compare}?
| | +--rw compare? enumeration | | +--rw compare? enumeration
| | +--rw action? identityref | | +--rw action? identityref
| +--rw pattern-match? string {select-match}? | +--rw pattern-match? string {select-match}?
+--rw file {file-action}? +--rw file {file-action}?
| +--rw log-file* [name] | +--rw log-file* [name]
| +--rw name inet:uri | +--rw name inet:uri
| +--rw filter | +--rw filter
| | +--rw facility-list* [facility severity] | | +--rw facility-list* [facility severity]
| | +--rw facility union | | +--rw facility union
| | +--rw severity union | | +--rw severity union
| | +--rw advanced-compare {select-adv-compare}? | | +--rw advanced-compare {select-adv-compare}?
| | +--rw compare? enumeration | | +--rw compare? enumeration
| | +--rw action? identityref | | +--rw action? identityref
| +--rw pattern-match? string {select-match}? | +--rw pattern-match? string {select-match}?
| +--rw structured-data? boolean {structured-data}? | +--rw structured-data? boolean {structured-data}?
| +--rw file-rotation | +--rw file-rotation
| +--rw number-of-files? uint32 {file-limit-size}? | +--rw number-of-files? uint32 {file-limit-size}?
| +--rw max-file-size? uint32 {file-limit-size}? | +--rw max-file-size? uint32 {file-limit-size}?
| +--rw rollover? uint32 | +--rw rollover? uint32
| | {file-limit-duration}? | | {file-limit-duration}?
| +--rw retention? uint32 | +--rw retention? uint32
| {file-limit-duration}? | {file-limit-duration}?
+--rw remote {remote-action}? +--rw remote {remote-action}?
+--rw destination* [name] +--rw destination* [name]
+--rw name string +--rw name string
+--rw (transport) +--rw (transport)
| +--:(udp) | +--:(udp)
| | +--rw udp | | +--rw udp
| | +--rw udp* [address] | | +--rw udp* [address]
| | +--rw address inet:host | | +--rw address inet:host
| | +--rw port? inet:port-number | | +--rw port? inet:port-number
| +--:(tls) | +--:(tls)
| +--rw tls | +--rw tls
| +--rw tls* [address] | +--rw tls* [address]
| +--rw address inet:host | +--rw address inet:host
| +--rw port? | +--rw port?
| | inet:port-number | | inet:port-number
| +--rw client-identity! | +--rw client-identity!
| | +--rw (auth-type) | | +--rw (auth-type)
| | ... | | ...
| +--rw server-authentication | +--rw server-authentication
| | +--rw ca-certs! {server-auth-x509-cert}? | | +--rw ca-certs! {server-auth-x509-cert}?
| | | ... | | | ...
| | +--rw ee-certs! {server-auth-x509-cert}? | | +--rw ee-certs! {server-auth-x509-cert}?
| | | ... | | | ...
| | +--rw raw-public-keys! | | +--rw raw-public-keys!
| | | {server-auth-raw-public-key}? | | | {server-auth-raw-public-key}?
| | | ... | | | ...
| | +--rw tls12-psks? empty | | +--rw tls12-psks? empty
| | | {server-auth-tls12-psk}? | | | {server-auth-tls12-psk}?
| | +--rw tls13-epsks? empty | | +--rw tls13-epsks? empty
| | {server-auth-tls13-epsk}? | | {server-auth-tls13-epsk}?
| +--rw hello-params {tlscmn:hello-params}? | +--rw hello-params {tlscmn:hello-params}?
| | +--rw tls-versions | | +--rw tls-versions
| | | ... | | | ...
| | +--rw cipher-suites | | +--rw cipher-suites
| | ... | | ...
| +--rw keepalives {tls-client-keepalives}? | +--rw keepalives {tls-client-keepalives}?
| +--rw peer-allowed-to-send? empty | +--rw peer-allowed-to-send? empty
| +--rw test-peer-aliveness! | +--rw test-peer-aliveness!
| ... | ...
+--rw filter +--rw filter
| +--rw facility-list* [facility severity] | +--rw facility-list* [facility severity]
| +--rw facility union | +--rw facility union
| +--rw severity union | +--rw severity union
| +--rw advanced-compare {select-adv-compare}? | +--rw advanced-compare {select-adv-compare}?
| +--rw compare? enumeration | +--rw compare? enumeration
| +--rw action? identityref | +--rw action? identityref
+--rw pattern-match? string {select-match}? +--rw pattern-match? string {select-match}?
+--rw structured-data? boolean {structured-data}? +--rw structured-data? boolean {structured-data}?
+--rw facility-override? identityref +--rw facility-override? identityref
+--rw source-interface? if:interface-ref +--rw source-interface? if:interface-ref
| {remote-source-interface}? | {remote-source-interface}?
+--rw signing! {signed-messages}? +--rw signing! {signed-messages}?
+--rw cert-signers +--rw cert-signers
+--rw cert-signer* [name] +--rw cert-signer* [name]
| +--rw name string | +--rw name string
| +--rw cert | +--rw cert
| | +--rw public-key-format? | | +--rw public-key-format?
| | | identityref | | | identityref
| | +--rw public-key? binary | | +--rw public-key? binary
| | +--rw private-key-format? | | +--rw private-key-format?
| | | identityref | | | identityref
| | +--rw (private-key-type) | | +--rw (private-key-type)
| | | +--:(cleartext-private-key) | | | +--:(cleartext-private-key)
| | | | {cleartext-private-keys}? | | | | {cleartext-private-keys}?
| | | | ... | | | | ...
| | | +--:(hidden-private-key) | | | +--:(hidden-private-key)
| | | | {hidden-private-keys}? | | | | {hidden-private-keys}?
| | | | ... | | | | ...
| | | +--:(encrypted-private-key) | | | +--:(encrypted-private-key)
| | | {encrypted-private-keys}? | | | {encrypted-private-keys}?
| | | ... | | | ...
| | +--rw cert-data? | | +--rw cert-data?
| | | end-entity-cert-cms | | | end-entity-cert-cms
| | +---n certificate-expiration | | +---n certificate-expiration
| | | {certificate-expiration-notification} | | | {certificate-expiration-notificati\
? on}?
| | | +-- expiration-date | | | +-- expiration-date
| | | yang:date-and-time | | | yang:date-and-time
| | +---x generate-csr {csr-generation}? | | +---x generate-csr {csr-generation}?
| | +---w input | | +---w input
| | | ... | | | ...
| | +--ro output | | +--ro output
| | ... | | ...
| +--rw hash-algorithm? enumeration | +--rw hash-algorithm? enumeration
+--rw cert-initial-repeat? uint32 +--rw cert-initial-repeat? uint32
+--rw cert-resend-delay? uint32 +--rw cert-resend-delay? uint32
+--rw cert-resend-count? uint32 +--rw cert-resend-count? uint32
+--rw sig-max-delay? uint32 +--rw sig-max-delay? uint32
+--rw sig-number-resends? uint32 +--rw sig-number-resends? uint32
+--rw sig-resend-delay? uint32 +--rw sig-resend-delay? uint32
+--rw sig-resend-count? uint32 +--rw sig-resend-count? uint32
Figure 1: Tree Diagram for Syslog Model Figure 2: Tree Diagram for Syslog Model
6. Syslog YANG Module 5. Syslog YANG Module
6.1. The ietf-syslog Module 5.1. The ietf-syslog Module
This module imports typedefs from [RFC6991], [RFC8343], groupings This module imports typedefs from [RFC6991], [RFC8343], groupings
from [I-D.ietf-netconf-crypto-types], and from [RFC9640], and [RFC9645]. It references [RFC5424], [RFC5425],
[I-D.ietf-netconf-tls-client-server], and it references [RFC5424], [RFC5426], [RFC5848], [RFC8089], [RFC8174], and [Std-1003.1-2024].
[RFC5425], [RFC5426], [RFC5848], [RFC8089], [RFC8174], and
[Std-1003.1-2008].
<CODE BEGINS> file "ietf-syslog@2024-09-18.yang" <CODE BEGINS> file "ietf-syslog@2025-03-03.yang"
module ietf-syslog { module ietf-syslog {
yang-version 1.1; yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-syslog"; namespace "urn:ietf:params:xml:ns:yang:ietf-syslog";
prefix syslog; prefix syslog;
import ietf-inet-types {
prefix inet;
reference
"RFC 6991: Common YANG Data Types";
}
import ietf-interfaces {
prefix if;
reference
"RFC 8343: A YANG Data Model for Interface Management";
}
import ietf-tls-client {
prefix tlsc;
reference
"I-D.ietf-netconf-tls-client-server:
YANG Groupings for TLS Clients and TLS Servers";
}
import ietf-crypto-types {
prefix ct;
reference
"I-D.ietf-netconf-crypto-types: YANG Data Types for
Cryptography";
}
organization import ietf-inet-types {
"IETF NETMOD (Network Modeling) Working Group"; prefix inet;
contact reference
"WG Web: <https://datatracker.ietf.org/wg/netmod/> "RFC 6991: Common YANG Data Types";
WG List: <mailto:netmod@ietf.org> }
import ietf-interfaces {
prefix if;
reference
"RFC 8343: A YANG Data Model for Interface Management";
}
import ietf-tls-client {
prefix tlsc;
reference
"RFC 9645: YANG Groupings for TLS Clients and TLS Servers";
}
import ietf-crypto-types {
prefix ct;
reference
"RFC 9640: YANG Data Types and Groupings for Cryptography";
}
Editor: Mahesh Jethanandani organization
<mailto:mjethanandani@gmail.com> "IETF NETMOD (Network Modeling) Working Group";
contact
"WG Web: <https://datatracker.ietf.org/wg/netmod/>
WG List: <mailto:netmod@ietf.org>
Editor: Joe Clarke Editor: Mahesh Jethanandani
<mailto:jclarke@cisco.com> <mailto:mjethanandani@gmail.com>
Editor: Kiran Agrahara Sreenivasa Editor: Joe Clarke
<mailto:kirankoushik.agraharasreenivasa@verizonwireless.com> <mailto:jclarke@cisco.com>
Editor: Clyde Wildes Editor: Kiran Agrahara Sreenivasa
<mailto:clyde@clydewildes.com>"; <mailto:kirankoushik.agraharasreenivasa@verizonwireless.com>
description
"This module contains a collection of YANG definitions
for syslog configuration.
Copyright (c) 2024 IETF Trust and the persons identified as Editor: Clyde Wildes
authors of the code. All rights reserved. <mailto:clyde@clydewildes.com>";
description
"This module contains a collection of YANG definitions
for syslog management.
Redistribution and use in source and binary forms, with or Copyright (c) 2025 IETF Trust and the persons identified as
without modification, is permitted pursuant to, and subject authors of the code. All rights reserved.
to the license terms contained in, the Revised BSD License
set forth in Section 4.c of the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC zzzz Redistribution and use in source and binary forms, with or
(https://www.rfc-editor.org/info/rfczzzz); without modification, is permitted pursuant to, and subject
see the RFC itself for full legal notices. to the license terms contained in, the Revised BSD License
set forth in Section 4.c of the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info).
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL This version of this YANG module is part of RFC 9742
NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', (https://www.rfc-editor.org/info/rfc9742);
see the RFC itself for full legal notices.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
are to be interpreted as described in BCP 14 (RFC 2119) are to be interpreted as described in BCP 14 (RFC 2119)
(RFC 8174) when, and only when, they appear in all capitals, (RFC 8174) when, and only when, they appear in all capitals,
as shown here."; as shown here.";
revision 2024-09-18 {
description
"Initial Revision";
reference
"RFC zzzz: Syslog YANG Model";
}
feature console-action {
description
"This feature indicates that the local console action is
supported.";
}
feature file-action {
description
"This feature indicates that the local file action is
supported.";
}
feature file-limit-size {
description
"This feature indicates that file logging resources
are managed using size and number limits.";
}
feature file-limit-duration {
description
"This feature indicates that file logging resources
are managed using time based limits.";
}
feature remote-action {
description
"This feature indicates that the remote server action is
supported.";
}
feature remote-source-interface {
description
"This feature indicates that source-interface is supported
supported for the remote-action.";
}
feature select-adv-compare {
description
"This feature represents the ability to select messages
using the additional comparison operators when comparing
the syslog message severity.";
}
feature select-match {
description
"This feature represents the ability to select messages
based on a Posix 1003.2 regular expression pattern
match.";
}
feature structured-data {
description
"This feature represents the ability to log messages
in structured-data format.";
reference
"RFC 5424: The Syslog Protocol";
}
feature signed-messages {
description
"This feature represents the ability to configure signed
syslog messages.";
reference
"RFC 5848: Signed Syslog Messages";
}
typedef syslog-severity {
type enumeration {
enum emergency {
value 0;
description
"The severity level 'Emergency' indicating that the
system is unusable.";
}
enum alert {
value 1;
description
"The severity level 'Alert' indicating that an
action must be taken immediately.";
}
enum critical {
value 2;
description
"The severity level 'Critical' indicating a
critical condition.";
}
enum error {
value 3;
description
"The severity level 'Error' indicating an error
condition.";
}
enum warning {
value 4;
description
"The severity level 'Warning' indicating a warning
condition.";
}
enum notice {
value 5;
description
"The severity level 'Notice' indicating a normal
but significant condition.";
}
enum info {
value 6;
description
"The severity level 'Info' indicating an
informational message.";
}
enum debug {
value 7;
description
"The severity level 'Debug' indicating a
debug-level message.";
}
}
description
"The definitions for Syslog message severity.
Note that a lower value is a higher severity. Comparisons
of equal-or-higher severity mean equal or lower numeric
value";
reference
"RFC 5424: The Syslog Protocol";
}
identity syslog-facility {
description
"This identity is used as a base for all syslog
facilities.";
reference
"RFC 5424: The Syslog Protocol";
}
identity kern { revision 2025-03-03 {
base syslog-facility; description
description "Initial Revision";
"The facility for kernel messages (0)."; reference
reference "RFC 9742: Syslog YANG Module";
"RFC 5424: The Syslog Protocol"; }
}
identity user { feature console-action {
base syslog-facility; description
description "This feature indicates that the local console action is
"The facility for user-level messages (1)."; supported.";
reference }
"RFC 5424: The Syslog Protocol";
}
identity mail { feature file-action {
base syslog-facility; description
description "This feature indicates that the local file action is
"The facility for the mail system (2)."; supported.";
reference }
"RFC 5424: The Syslog Protocol";
}
identity daemon { feature file-limit-size {
base syslog-facility; description
description "This feature indicates that file logging resources
"The facility for the system daemons (3)."; are managed using size and number limits.";
reference }
"RFC 5424: The Syslog Protocol";
}
identity auth { feature file-limit-duration {
base syslog-facility; description
description "This feature indicates that file logging resources
"The facility for security/authorization messages (4)."; are managed using time based limits.";
reference }
"RFC 5424: The Syslog Protocol";
}
identity syslog { feature remote-action {
base syslog-facility; description
description "This feature indicates that the remote server action is
"The facility for messages generated internally by syslogd supported.";
facility (5)."; }
reference
"RFC 5424: The Syslog Protocol";
}
identity lpr { feature remote-source-interface {
base syslog-facility; description
description "This feature indicates that source-interface is supported
"The facility for the line printer subsystem (6)."; for the remote-action.";
reference }
"RFC 5424: The Syslog Protocol";
}
identity news { feature select-adv-compare {
base syslog-facility; description
description "This feature represents the ability to select messages
"The facility for the network news subsystem (7)."; using the additional comparison operators when comparing
reference the syslog message severity.";
"RFC 5424: The Syslog Protocol"; }
}
identity uucp { feature select-match {
base syslog-facility; description
description "This feature represents the ability to select messages
"The facility for the UUCP subsystem (8)."; based on a Posix 1003.2 regular expression pattern
reference match.";
"RFC 5424: The Syslog Protocol"; }
}
identity cron { feature structured-data {
base syslog-facility; description
description "This feature represents the ability to log messages
"The facility for the clock daemon (9)."; in structured-data format.";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol";
} }
identity authpriv { feature signed-messages {
base syslog-facility; description
description "This feature represents the ability to configure signed
"The facility for privileged security/authorization syslog messages.";
messages (10)."; reference
reference "RFC 5848: Signed Syslog Messages";
"RFC 5424: The Syslog Protocol"; }
}
identity ftp { typedef syslog-severity {
base syslog-facility; type enumeration {
description enum emergency {
"The facility for the FTP daemon (11)."; value 0;
description
"The severity level 'Emergency' indicates that the
system is unusable.";
}
enum alert {
value 1;
description
"The severity level 'Alert' indicates that an
action must be taken immediately.";
}
enum critical {
value 2;
description
"The severity level 'Critical' indicates a
critical condition.";
}
enum error {
value 3;
description
"The severity level 'Error' indicates an error
condition.";
}
enum warning {
value 4;
description
"The severity level 'Warning' indicates a warning
condition.";
}
enum notice {
value 5;
description
"The severity level 'Notice' indicates a normal
but significant condition.";
}
enum info {
value 6;
description
"The severity level 'Info' indicates an
informational message.";
}
enum debug {
value 7;
description
"The severity level 'Debug' indicates a
debug-level message.";
}
}
description
"The definitions for Syslog message severity.
Note that a lower value is a higher severity. Comparisons
of equal-or-higher severity mean equal-or-lower numeric
value";
reference
"RFC 5424: The Syslog Protocol";
}
reference identity syslog-facility {
"RFC 5424: The Syslog Protocol"; description
} "This identity is used as a base for all syslog
facilities.";
reference
"RFC 5424: The Syslog Protocol";
}
identity ntp { identity kern {
base syslog-facility; base syslog-facility;
description description
"The facility for the NTP subsystem (12)."; "The facility for kernel messages (numerical code 0).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity audit { identity user {
base syslog-facility; base syslog-facility;
description description
"The facility for log audit messages (13)."; "The facility for user-level messages (numerical code 1).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity console { identity mail {
base syslog-facility; base syslog-facility;
description description
"The facility for log alert messages (14)."; "The facility for the mail system (numerical code 2).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity cron2 { identity daemon {
base syslog-facility; base syslog-facility;
description description
"The facility for the second clock daemon (15)."; "The facility for the system daemons (numerical code 3).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity local0 { identity auth {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 0 messages (16)."; "The facility for security/authorization messages (numerical
reference code 4).";
"RFC 5424: The Syslog Protocol"; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity local1 { identity syslog {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 1 messages (17)."; "The facility for messages generated internally by a syslog
daemon facility (numerical code 5).";
reference
"RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
reference identity lpr {
"RFC 5424: The Syslog Protocol"; base syslog-facility;
} description
"The facility for the line printer subsystem (numerical code
6).";
reference
"RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity local2 { identity news {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 2 messages (18)."; "The facility for the network news subsystem (numerical code
reference 7).";
"RFC 5424: The Syslog Protocol"; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity local3 { identity uucp {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 3 messages (19)."; "The facility for the Unix-to-Unix Copy (UUCP) subsystem
reference (numerical code 8).";
"RFC 5424: The Syslog Protocol"; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity local4 { identity cron {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 4 messages (20)."; "The facility for the clock daemon (numerical code 9).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity local5 { identity authpriv {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 5 messages (21)."; "The facility for privileged security/authorization messages
reference (numerical code 10).";
"RFC 5424: The Syslog Protocol"; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity local6 { identity ftp {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 6 messages (22)."; "The facility for the FTP daemon (numerical code 11).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity local7 { identity ntp {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 7 messages (23)."; "The facility for the NTP subsystem (numerical code 12).";
reference
"RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
reference identity audit {
"RFC 5424: The Syslog Protocol"; base syslog-facility;
} description
"The facility for log audit messages (numerical code 13).";
reference
"RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity action { identity console {
description base syslog-facility;
"Base identity for action for how a message will be description
handled."; "The facility for log alert messages (numerical code 14).";
} reference
"RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity log { identity cron2 {
base action; base syslog-facility;
description description
"This identity specifies that if the compare operation is "The facility for the second clock daemon (numerical code
true the message will be logged."; 15).";
} reference
"RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity block { identity local0 {
base action; base syslog-facility;
description description
"This identity specifies that if the compare operation is "The facility for local use 0 messages (numerical code 16).";
true the message will not be logged."; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity stop { identity local1 {
base action; base syslog-facility;
description description
"This identity specifies that if the compare operation is "The facility for local use 1 messages (numerical code 17).";
true the message will not be logged and no further reference
processing will occur for it."; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
grouping severity-filter { identity local2 {
description base syslog-facility;
"This grouping defines the processing used to select description
log messages by comparing syslog message severity using "The facility for local use 2 messages (numerical code 18).";
the following processing rules: reference
- if 'none', do not match. "RFC 5424: The Syslog Protocol, Section 6.2.1.";
- if 'all', match. }
- else compare message severity with the specified
severity according to the default compare rule (all
messages of the specified severity and greater match)
or if the select-adv-compare feature is present, use
the advance-compare rule.";
leaf severity { identity local3 {
type union { base syslog-facility;
type syslog-severity; description
type enumeration { "The facility for local use 3 messages (numerical code 19).";
enum none { reference
value 2147483647; "RFC 5424: The Syslog Protocol";
description }
"This enum describes the case where no
severities are selected.";
}
enum all {
value -2147483648;
description
"This enum describes the case where all
severities are selected.";
}
}
}
mandatory true;
description
"This leaf specifies the syslog message severity.";
}
container advanced-compare { identity local4 {
when "../severity != \"all\" and base syslog-facility;
../severity != \"none\"" { description
description "The facility for local use 4 messages (numerical code 20).";
"The advanced compare container is not applicable reference
for severity 'all' or severity 'none'"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
if-feature "select-adv-compare";
leaf compare { identity local5 {
type enumeration { base syslog-facility;
enum equals { description
description "The facility for local use 5 messages (numerical code 21).";
"This enum specifies that the severity reference
comparison operation will be equals."; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
enum equals-or-higher {
description
"This enum specifies that the severity
comparison operation will be equals or
higher.";
}
}
default "equals-or-higher";
description
"The compare can be used to specify the comparison
operator that should be used to compare the syslog
message severity with the specified severity.";
} identity local6 {
base syslog-facility;
description
"The facility for local use 6 messages (numerical code 22).";
reference
"RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
leaf action { identity local7 {
type identityref { base syslog-facility;
base "action"; description
} "The facility for local use 7 messages (numerical code 23).";
default "log"; reference
description "RFC 5424: The Syslog Protocol, Section 6.2.1.";
"The action can be used to specify how the message }
should be handled. This may include logging the
message, not logging the message (i.e., blocking
it), or stopping further processing.";
}
description
"This container describes additional severity compare
operations that can be used in place of the default
severity comparison. The compare leaf specifies the
type of the compare that is done and the action leaf
specifies the intended result.
Example: compare->equals and action->block means
messages that have a severity that are equal to the
specified severity will not be logged.";
}
}
grouping selector { identity action {
description description
"This grouping defines a syslog selector which is used to "Base identity for action for how a message will be
select log messages for the log-actions (console, file, handled.";
remote, etc.). Choose one or both of the following: }
facility [<facility> <severity>...]
pattern-match regular-expression-match-string
If both facility and pattern-match are specified, both
must match in order for a log message to be selected.";
container filter { identity log {
description base action;
"This container describes the syslog filter description
parameters."; "This identity specifies that if the compare operation is
true, the message will be logged.";
}
list facility-list { identity block {
key "facility severity"; base action;
ordered-by user; description
description "This identity specifies that if the compare operation is
"This list describes a collection of syslog true, the message will not be logged.";
facilities and severities."; }
leaf facility { identity stop {
type union { base action;
type identityref { description
base syslog-facility; "This identity specifies that if the compare operation is
} true, the message will not be logged and no further
type enumeration { processing will occur for it.";
enum all { }
description
"This enum describes the case where
all facilities are requested.";
}
}
}
description
"The leaf uniquely identifies a syslog
facility.";
}
uses severity-filter;
}
}
leaf pattern-match { grouping severity-filter {
if-feature "select-match"; description
type string; "This grouping defines the processing used to select
description log messages by comparing syslog message severity using
"This leaf describes a Posix 1003.2 regular expression the following processing rules:
string that can be used to select a syslog message for - if 'none', do not match.
logging. The match is performed on the SYSLOG-MSG - if 'all', match.
field."; - else, compare message severity with the specified
reference severity according to the default compare rule (all
"RFC 5424: The Syslog Protocol messages of the specified severity and greater match)
Std-1003.1-2008 Regular Expressions"; or if the select-adv-compare feature is present, use
} the advance-compare rule.";
} leaf severity {
type union {
type syslog-severity;
type enumeration {
enum none {
value 2147483647;
description
"This enum describes the case where no
severities are selected.";
}
enum all {
value -2147483648;
description
"This enum describes the case where all
severities are selected.";
}
}
}
mandatory true;
description
"This leaf specifies the syslog message severity.";
}
container advanced-compare {
when "../severity != \"all\" and
../severity != \"none\"" {
description
"The advanced compare container is not applicable
for severity 'all' or severity 'none'";
}
if-feature "select-adv-compare";
leaf compare {
type enumeration {
enum equals {
description
"This enum specifies that the severity
comparison operation will be equals.";
}
enum equals-or-higher {
description
"This enum specifies that the severity
comparison operation will be equals or
higher.";
}
}
default "equals-or-higher";
description
"The compare operation can be used to specify the comparison
operator that should be used to compare the syslog
message severity with the specified severity.";
}
leaf action {
type identityref {
base action;
}
default "log";
description
"The action can be used to specify how the message
should be handled. This may include logging the
message, not logging the message (i.e., blocking
it), or stopping further processing.";
}
description
"This container describes additional severity compare
operations that can be used in place of the default
severity comparison. The compare leaf specifies the
type of compare operation that is done and the
action leaf specifies the intended result.
Example: compare->equals and action->block means
messages that have a severity that are equal to the
specified severity will not be logged.";
}
}
grouping structured-data { grouping selector {
description description
"This grouping defines the syslog structured data option "This grouping defines a syslog selector, which is used to
which is used to select the format used to write log select log messages for the log-actions (console, file,
messages."; remote, etc.). Choose one or both of the following:
facility [<facility> <severity>...]
pattern-match regular-expression-match-string
If both facility and pattern-match are specified, both
must match in order for a log message to be selected.";
container filter {
description
"This container describes the syslog filter
parameters.";
list facility-list {
key "facility severity";
ordered-by user;
description
"This list describes a collection of syslog
facilities and severities.";
leaf facility {
type union {
type identityref {
base syslog-facility;
}
type enumeration {
enum all {
description
"This enum describes the case where
all facilities are requested.";
}
}
}
description
"The leaf uniquely identifies a syslog
facility.";
}
uses severity-filter;
}
}
leaf pattern-match {
if-feature "select-match";
type string;
description
"This leaf describes a Posix 1003.2 regular expression
string that can be used to select a syslog message for
logging. The match is performed on the SYSLOG-MSG
field.";
reference
"RFC 5424: The Syslog Protocol
Std-1003.1-2024 Regular Expressions";
}
}
leaf structured-data { grouping structured-data {
if-feature "structured-data"; description
type boolean; "This grouping defines the syslog structured data option,
default "false"; which is used to select the format used to write log
description messages.";
"This leaf describes how log messages are written. leaf structured-data {
If true, messages will be written with one or more if-feature "structured-data";
STRUCTURED-DATA elements; if false, messages will be type boolean;
written with STRUCTURED-DATA = NILVALUE."; default "false";
reference description
"RFC 5424: The Syslog Protocol"; "This leaf describes how log messages are written.
} If true, messages will be written with one or more
} STRUCTURED-DATA elements; if false, messages will be
written with STRUCTURED-DATA = NILVALUE.";
reference
"RFC 5424: The Syslog Protocol";
}
}
container syslog { container syslog {
presence presence "Enables logging.";
"Enables logging."; description
description "This container describes the configuration parameters for
"This container describes the configuration parameters for
syslog."; syslog.";
container actions {
container actions { description
description "This container describes the log-action parameters
"This container describes the log-action parameters for syslog.";
for syslog."; container console {
if-feature "console-action";
container console { presence "Enables logging to the console";
if-feature "console-action"; description
presence "This container describes the configuration
"Enables logging to the console"; parameters for console logging.";
description uses selector;
"This container describes the configuration }
parameters for console logging."; container file {
uses selector; if-feature "file-action";
} description
"This container describes the configuration
container file { parameters for file logging. If file-archive
if-feature "file-action"; limits are not supplied, it is assumed that
description the local implementation defined limits will
"This container describes the configuration be used.";
parameters for file logging. If file-archive list log-file {
limits are not supplied, it is assumed that key "name";
the local implementation defined limits will description
be used."; "This list describes a collection of local
logging files.";
list log-file { leaf name {
key "name"; type inet:uri {
description pattern 'file:.*';
"This list describes a collection of local }
logging files."; description
"This leaf specifies the name of the log
leaf name { file, which MUST use the uri scheme
type inet:uri { file:.";
pattern reference
'file:.*'; "RFC 8089: The file URI Scheme";
} }
description uses selector;
"This leaf specifies the name of the log uses structured-data;
file which MUST use the uri scheme container file-rotation {
file:."; description
reference "This container describes the configuration
"RFC 8089: The file URI Scheme"; parameters for log file rotation.";
} leaf number-of-files {
if-feature "file-limit-size";
uses selector; type uint32;
uses structured-data; default "1";
description
container file-rotation { "This leaf specifies the maximum number
description of log files retained. Specify 1 for
"This container describes the configuration implementations that only support one
parameters for log file rotation."; log file.";
leaf number-of-files { }
if-feature "file-limit-size"; leaf max-file-size {
type uint32; if-feature "file-limit-size";
default "1"; type uint32;
description units "megabytes";
"This leaf specifies the maximum number description
of log files retained. Specify 1 for "This leaf specifies the maximum log
implementations that only support one file size.";
log file."; }
} leaf rollover {
if-feature "file-limit-duration";
leaf max-file-size { type uint32;
if-feature "file-limit-size"; units "minutes";
type uint32; description
units "megabytes"; "This leaf specifies the length of time
description that log events should be written to a
"This leaf specifies the maximum log specific log file. Log events that
file size."; arrive after the rollover period cause
} the current log file to be closed and
a new log file to be opened.";
leaf rollover { }
if-feature "file-limit-duration"; leaf retention {
type uint32; if-feature "file-limit-duration";
units "minutes"; type uint32;
description units "minutes";
"This leaf specifies the length of time description
that log events should be written to a "This leaf specifies the length of time
specific log file. Log events that that completed/closed log event files
arrive after the rollover period cause should be stored in the file system
the current log file to be closed and before they are removed.";
a new log file to be opened."; }
} }
leaf retention { }
if-feature "file-limit-duration"; }
type uint32; container remote {
units "minutes"; if-feature "remote-action";
description description
"This leaf specifies the length of time "This container describes the configuration
that completed/closed log event files parameters for forwarding syslog messages
should be stored in the file system to remote relays or collectors.";
before they are removed."; list destination {
} key "name";
} description
} "This list describes a collection of remote logging
} destinations.";
leaf name {
container remote { type string;
if-feature "remote-action"; description
description "An arbitrary name for the endpoint to connect to.";
"This container describes the configuration }
parameters for forwarding syslog messages choice transport {
to remote relays or collectors."; mandatory true;
description
list destination { "This choice describes the transport option.";
key "name"; case udp {
description container udp {
"This list describes a collection of remote logging description
destinations."; "This container describes the UDP transport
leaf name { options.";
type string; reference
description "RFC 5426: Transmission of Syslog Messages over
"An arbitrary name for the endpoint to connect to."; UDP";
} list udp {
key "address";
choice transport { description
mandatory true; "List of all UDP sessions.";
description leaf address {
"This choice describes the transport option."; type inet:host;
description
case udp { "The leaf uniquely specifies the address of the
container udp {
description
"This container describes the UDP transport
options.";
reference
"RFC 5426: Transmission of Syslog Messages over
UDP";
list udp {
key "address";
description
"List of all UDP sessions.";
leaf address {
type inet:host;
description
"The leaf uniquely specifies the address of the
remote host. One of the following must be remote host. One of the following must be
specified: specified:
- an ipv4 address, - an ipv4 address,
- an ipv6 address, or a - an ipv6 address, or a
- host name."; - host name.";
} }
leaf port {
leaf port { type inet:port-number;
type inet:port-number; default "514";
default "514"; description
description "This leaf specifies the port number used to
"This leaf specifies the port number used to
deliver messages to the remote server."; deliver messages to the remote server.";
} }
} }
} }
} }
case tls {
case tls { container tls {
container tls { description
description "This container describes the TLS transport
"This container describes the TLS transport options.";
options."; reference
reference "RFC 5425: Transport Layer Security (TLS) Transport
"RFC 5425: Transport Layer Security (TLS) Transport Mapping for Syslog ";
Mapping for Syslog "; list tls {
key "address";
list tls { description
key "address"; "List of all TLS-based sessions.";
description leaf address {
"List of all TLS based sessions."; type inet:host;
description
leaf address { "The leaf uniquely specifies the address of the
type inet:host; remote host. One of the following must be
description specified: an ipv4 address, an ipv6 address,
"The leaf uniquely specifies the address of the or a host name.";
remote host. One of the following must be }
specified: an ipv4 address, an ipv6 address, or leaf port {
a host name."; type inet:port-number;
} default "6514";
leaf port { description
type inet:port-number; "TCP port 6514 has been allocated as the
default "6514"; default port for syslog over TLS.";
description }
"TCP port 6514 has been allocated as the uses tlsc:tls-client-grouping;
default port for syslog over TLS."; }
} }
uses tlsc:tls-client-grouping; }
} }
} uses selector;
} uses structured-data;
} leaf facility-override {
type identityref {
uses selector; base syslog-facility;
uses structured-data; }
description
leaf facility-override { "If specified, this leaf specifies the facility used
type identityref { to override the facility in messages delivered to the
base syslog-facility; remote server.";
} }
description leaf source-interface {
"If specified, this leaf specifies the facility used if-feature "remote-source-interface";
to override the facility in messages delivered to the type if:interface-ref;
remote server."; description
} "This leaf sets the source interface to be used to
send messages to the remote syslog server. If not set,
leaf source-interface { messages can be sent on any interface.";
if-feature "remote-source-interface"; }
type if:interface-ref; container signing {
description if-feature "signed-messages";
"This leaf sets the source interface to be used to presence "If present, syslog-signing options is
send messages to the remote syslog server. If not set, activated.";
messages can be sent on any interface."; description
} "This container describes the configuration
parameters for signed syslog messages.";
container signing { reference
if-feature "signed-messages"; "RFC 5848: Signed Syslog Messages";
presence container cert-signers {
"If present, syslog-signing options is activated."; description
description "This container describes the signing certificate
"This container describes the configuration configuration for Signature Group 0, which covers
parameters for signed syslog messages."; the case for administrators who want all Signature
reference Blocks to be sent to a single destination.";
"RFC 5848: Signed Syslog Messages"; list cert-signer {
key "name";
container cert-signers { description
description "This list describes a collection of syslog message
"This container describes the signing certificate signers.";
configuration for Signature Group 0 which covers the leaf name {
case for administrators who want all Signature type string;
Blocks to be sent to a single destination."; description
"This leaf specifies the name of the syslog
list cert-signer { message signer.";
key "name"; }
description container cert {
"This list describes a collection of syslog message uses ct:asymmetric-key-pair-with-cert-grouping;
signers."; description
"This is the certificate that is periodically
leaf name { sent to the remote receiver. The certificate is
type string; inherently associated with its private
description and public keys.";
"This leaf specifies the name of the syslog }
message signer."; leaf hash-algorithm {
} type enumeration {
enum SHA1 {
container cert { value 1;
uses ct:asymmetric-key-pair-with-cert-grouping; description
description "This enum describes the SHA1 algorithm.";
"This is the certificate that is periodically }
sent to the remote receiver. The certificate is enum SHA256 {
inherently associated with its private value 2;
and public keys."; description
} "This enum describes the SHA256 algorithm.";
}
leaf hash-algorithm { }
type enumeration { description
enum SHA1 { "This leaf describes the syslog signer hash
value 1; algorithm used.";
description }
"This enum describes the SHA1 algorithm."; }
} leaf cert-initial-repeat {
enum SHA256 { type uint32;
value 2; default "3";
description description
"This enum describes the SHA256 algorithm."; "This leaf specifies the number of times each
} Certificate Block should be sent before the first
} message is sent.";
description }
"This leaf describes the syslog signer hash leaf cert-resend-delay {
algorithm used."; type uint32;
} units "seconds";
} default "3600";
description
leaf cert-initial-repeat { "This leaf specifies the maximum time delay in
type uint32; seconds until resending the Certificate Block.";
default "3"; }
description leaf cert-resend-count {
"This leaf specifies the number of times each type uint32;
Certificate Block should be sent before the first default "0";
message is sent."; description
} "This leaf specifies the maximum number of other
syslog messages to send until resending the
leaf cert-resend-delay { Certificate Block.";
type uint32; }
units "seconds"; leaf sig-max-delay {
default "3600"; type uint32;
description units "seconds";
"This leaf specifies the maximum time delay in default "60";
seconds until resending the Certificate Block."; description
} "This leaf specifies when to generate a new
Signature Block. If this many seconds have elapsed
leaf cert-resend-count { since the message with the first message number
type uint32; of the Signature Block was sent, a new Signature
default "0"; Block should be generated.";
description }
"This leaf specifies the maximum number of other leaf sig-number-resends {
syslog messages to send until resending the type uint32;
Certificate Block."; default "0";
} description
"This leaf specifies the number of times a
leaf sig-max-delay { Signature Block is resent. (It is recommended to
type uint32; select a value of greater than 0 in particular
units "seconds"; when the UDP transport as in RFC 5426 is used.)";
default "60"; }
description leaf sig-resend-delay {
"This leaf specifies when to generate a new type uint32;
Signature Block. If this many seconds have elapsed units "seconds";
since the message with the first message number default "5";
of the Signature Block was sent, a new Signature description
Block should be generated."; "This leaf specifies when to send the next
} Signature Block transmission based on time. If
this many seconds have elapsed since the previous
leaf sig-number-resends { sending of this Signature Block, resend it.";
type uint32; }
default "0"; leaf sig-resend-count {
description type uint32;
"This leaf specifies the number of times a default "0";
Signature Block is resent. (It is recommended to description
select a value of greater than 0 in particular "This leaf specifies when to send the next
when the UDP transport RFC 5426 is used.)."; Signature Block transmission based on a count.
} If this many other syslog messages have been sent
since the previous sending of this Signature
leaf sig-resend-delay { Block, resend it. A value of 0 means that you
type uint32; don't resend based on the number of messages.";
units "seconds"; }
default "5"; }
description }
"This leaf specifies when to send the next }
Signature Block transmission based on time. If }
this many seconds have elapsed since the previous }
sending of this Signature Block, resend it."; }
}
leaf sig-resend-count {
type uint32;
default "0";
description
"This leaf specifies when to send the next
Signature Block transmission based on a count. If
this many other syslog messages have been sent
since the previous sending of this Signature
Block, resend it. A value of 0 means that you
don't resend based on the number of messages.";
}
}
}
}
}
}
}
} }
<CODE ENDS> <CODE ENDS>
Figure 2: Sylog YANG Model Figure 3: Syslog YANG Module
7. Usage Examples 6. Usage Examples
7.1. Syslog Configuration for Severity Critical The following examples are in XML [W3C.REC-xml-20081126].
[note: '\' line wrapping for formatting only] 6.1. Syslog Configuration for Severity Critical
<!-- This example shows how the console logging of syslog of severity
Enable console logging of syslogs of severity critical critical can be enabled.
-->
<?xml version="1.0" encoding="UTF-8"?> <?xml version="1.0" encoding="UTF-8"?>
<syslog xmlns="urn:ietf:params:xml:ns:yang:ietf-syslog"> <syslog xmlns="urn:ietf:params:xml:ns:yang:ietf-syslog">
<actions> <actions>
<console> <console>
<filter> <filter>
<facility-list> <facility-list>
<facility>all</facility> <facility>all</facility>
<severity>critical</severity> <severity>critical</severity>
</facility-list> </facility-list>
</filter> </filter>
</console> </console>
</actions> </actions>
</syslog> </syslog>
Figure 3: Syslog Configuration for Severity Critical Figure 4: Syslog Configuration for Severity Critical
7.2. Remote Syslog Configuration 6.2. Remote Syslog Configuration
[note: '\' line wrapping for formatting only] This example shows how the remote logging of syslogs to UDP
destination foo.example.com for facility auth and severity error can
be enabled.
<!--
Enable remote logging of syslogs to udp destination
foo.example.com for facility auth, severity error
-->
<?xml version="1.0" encoding="UTF-8"?> <?xml version="1.0" encoding="UTF-8"?>
<syslog xmlns="urn:ietf:params:xml:ns:yang:ietf-syslog"> <syslog xmlns="urn:ietf:params:xml:ns:yang:ietf-syslog">
<actions> <actions>
<remote> <remote>
<destination> <destination>
<name>remote1</name> <name>remote1</name>
<udp> <udp>
<udp> <udp>
<address>foo.example.com</address> <address>foo.example.com</address>
</udp> </udp>
</udp> </udp>
<filter> <filter>
<facility-list> <facility-list>
<facility>auth</facility> <facility>auth</facility>
<severity>error</severity> <severity>error</severity>
</facility-list> </facility-list>
</filter> </filter>
</destination> </destination>
</remote> </remote>
</actions> </actions>
</syslog> </syslog>
Figure 4: Remote Syslog Configuration Figure 5: Remote Syslog Configuration
8. Acknowledgements
The authors wish to thank the following who commented on this
proposal:
Andy Bierman, Martin Bjorklund, Alex Campbell, Alex Clemm, Francis 7. IANA Considerations
Dupont, Jim Gibson, Jeffrey Haas, Bob Harold, John Heasley, Giles
Heron, Lisa Huang, Mahesh Jethanandani, Warren Kumari, Jeffrey K
Lange, Jan Lindblad, Chris Lonvick, Alexey Melnikov, Kathleen
Moriarty, Tom Petch, Adam Roach, Juergen Schoenwaelder, Phil Shafer,
Yaron Sheffer, Jason Sterne, Peter Van Horne, Kent Watsen, Bert
Wijnen, Dale R Worley, and Aleksandr Zhdankin.
9. IANA Considerations 7.1. The IETF XML Registry
9.1. The IETF XML Registry
This document registers one URI in the IETF XML registry [RFC3688] . This document registers one URI in the "IETF XML Registry", following
Following the format in [RFC3688] , the following registration is the format defined in [RFC3688]:
requested:
URI: urn:ietf:params:xml:ns:yang:ietf-syslog URI: urn:ietf:params:xml:ns:yang:ietf-syslog
Registrant Contact: The IESG. Registrant Contact: The IESG.
XML: N/A, the requested URI is an XML namespace. XML: N/A; the requested URI is an XML namespace.
9.2. The YANG Module Names Registry 7.2. The YANG Module Names Registry
This document registers one YANG module in the YANG Module Names This document registers one YANG module in the "YANG Module Names"
registry [RFC8525] . Following the format in [RFC7950] , the registry [RFC8525], following the format in [RFC7950]:
following registration is requested:
name: ietf-syslog Name: ietf-syslog
namespace: urn:ietf:params:xml:ns:yang:ietf-syslog Namespace: urn:ietf:params:xml:ns:yang:ietf-syslog
prefix: syslog Prefix: syslog
reference: RFC zzzz Reference: RFC 9742
10. Security Considerations 8. Security Considerations
This section is modeled after the template defined in Section 3.7.1 This section is modeled after the template defined in
of [RFC8407]. [YANG-GUIDELINES].
The "ietf-syslog" YANG module specified in this document defines a The "ietf-syslog" YANG module defines a data model that is designed
data model that is designed to be accessed via YANG-based management to be accessed via YANG-based management protocols, such as NETCONF
protocols such as NETCONF [RFC6241] and RESTCONF [RFC8040]. These [RFC6241] and RESTCONF [RFC8040]. These protocols have to use a
protocols have mandatory-to-implement secure transport layers (e.g., secure transport layer (e.g., SSH [RFC4252], TLS [RFC8446], and QUIC
Secure Shell (SSH) [RFC4252], TLS [RFC8446], and QUIC [RFC9000]) and [RFC9000]) and have to use mutual authentication.
mandatory-to-implement mutual authentication.
The NETCONF access control model [RFC8341] provides the means to The Network Configuration Access Control Model (NACM) [RFC8341]
restrict access for particular NETCONF or RESTCONF users to a provides the means to restrict access for particular NETCONF or
preconfigured subset of all available NETCONF or RESTCONF protocol RESTCONF users to a preconfigured subset of all available NETCONF or
operations and content. RESTCONF protocol operations and content.
This module imports groupings from ietf-crypto-types YANG module This module imports groupings from ietf-crypto-types YANG module
defined in YANG Groupings for Crypto Types defined in YANG Groupings for Crypto Types [RFC9640]. Security
[I-D.ietf-netconf-crypto-types]. Security considerations described considerations described in that document apply to this module also.
in that document apply to this module also.
There are a number of data nodes defined in this YANG module that are There are a number of data nodes defined in this YANG module that are
writable/creatable/deletable (i.e., config true, which is the writable/creatable/deletable (i.e., "config true", which is the
default). These data nodes should be considered sensitive or default). All writable data nodes are likely to be reasonably
vulnerable in all network environments. Logging in particular is sensitive or vulnerable in some network environments. Write
used to assess the state of systems and can be used to indicate a operations (e.g., edit-config) and delete operations to these data
network compromise. If logging were to be disabled through malicious nodes without proper protection or authentication can have a negative
means, attacks may not be readily detectable. Therefore write effect on network operations. The following subtrees and data nodes
operations (e.g., edit-config) to these data nodes without proper have particular sensitivities/vulnerabilities:
protection can have a negative effect on network operations and on
network security.
In addition there are data nodes that require careful analysis and
review. These are the subtrees and data nodes and their sensitivity/
vulnerability:
facility-filter/pattern-match: When writing this node, facility-filter/pattern-match: When writing this node,
implementations MUST ensure that the regular expression pattern implementations MUST ensure that the regular expression pattern
match is not constructed to cause a regular expression denial match is not constructed to cause a regular expression denial-of-
of service attack due to a pattern that causes the regular service attack due to a pattern that causes the regular expression
expression implementation to work very slowly (exponentially implementation to work very slowly (exponentially related to input
related to input size). size).
remote/destination/signing/cert-signer: When writing this subtree, remote/destination/signing/cert-signer: When writing this subtree,
implementations MUST NOT specify a private key that is used for implementations MUST NOT specify a private key that is used for
any other purpose. any other purpose.
Some of the readable data nodes in this YANG module may be considered Some of the readable data nodes in this YANG module may be considered
sensitive or vulnerable in some network environments. It is thus sensitive or vulnerable in some network environments. It is thus
important to control read access (e.g., via get, get-config, or important to control read access (e.g., via get, get-config, or
notification) to these data nodes. These are the subtrees and data notification) to these data nodes. Specifically, the following
nodes and their sensitivity/vulnerability: subtrees and data nodes have particular sensitivities/
vulnerabilities:
remote/destination/transport: This subtree contains information remote/destination/transport: This subtree contains information
about other hosts in the network, the services available on about other hosts in the network, the services available on those
those hosts, and the TLS transport certificate properties if hosts, and the TLS transport certificate properties if TLS is
TLS is selected as the transport protocol. Knowing that a selected as the transport protocol. Knowing that a service like
service like syslog (udp/514) is enabled on the host, will syslog (udp/514) is enabled on the host will allow a malicious
allow a malicious user to spam the host on that port. user to spam the host on that port.
remote/destination/signing: This subtree contains information about remote/destination/signing: This subtree contains information about
the syslog message signing properties including signing the syslog message signing properties, including signing
certificate information. certificate information.
There are no RPC operations defined in this YANG module.
11. References
11.1. Normative References There are no particularly sensitive RPC or action operations.
[I-D.ietf-netconf-crypto-types] 9. References
Watsen, K., "YANG Data Types and Groupings for
Cryptography", Work in Progress, Internet-Draft, draft-
ietf-netconf-crypto-types-34, 16 March 2024,
<https://datatracker.ietf.org/doc/html/draft-ietf-netconf-
crypto-types-34>.
[I-D.ietf-netconf-tls-client-server] 9.1. Normative References
Watsen, K., "YANG Groupings for TLS Clients and TLS
Servers", Work in Progress, Internet-Draft, draft-ietf-
netconf-tls-client-server-41, 16 March 2024,
<https://datatracker.ietf.org/doc/html/draft-ietf-netconf-
tls-client-server-41>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997, DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>. <https://www.rfc-editor.org/info/rfc2119>.
[RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
DOI 10.17487/RFC3688, January 2004, DOI 10.17487/RFC3688, January 2004,
<https://www.rfc-editor.org/info/rfc3688>. <https://www.rfc-editor.org/info/rfc3688>.
[RFC4252] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH)
Authentication Protocol", RFC 4252, DOI 10.17487/RFC4252,
January 2006, <https://www.rfc-editor.org/info/rfc4252>.
[RFC5424] Gerhards, R., "The Syslog Protocol", RFC 5424, [RFC5424] Gerhards, R., "The Syslog Protocol", RFC 5424,
DOI 10.17487/RFC5424, March 2009, DOI 10.17487/RFC5424, March 2009,
<https://www.rfc-editor.org/info/rfc5424>. <https://www.rfc-editor.org/info/rfc5424>.
[RFC5425] Miao, F., Ed., Ma, Y., Ed., and J. Salowey, Ed., [RFC5425] Miao, F., Ed., Ma, Y., Ed., and J. Salowey, Ed.,
"Transport Layer Security (TLS) Transport Mapping for "Transport Layer Security (TLS) Transport Mapping for
Syslog", RFC 5425, DOI 10.17487/RFC5425, March 2009, Syslog", RFC 5425, DOI 10.17487/RFC5425, March 2009,
<https://www.rfc-editor.org/info/rfc5425>. <https://www.rfc-editor.org/info/rfc5425>.
[RFC5426] Okmianski, A., "Transmission of Syslog Messages over UDP", [RFC5426] Okmianski, A., "Transmission of Syslog Messages over UDP",
RFC 5426, DOI 10.17487/RFC5426, March 2009, RFC 5426, DOI 10.17487/RFC5426, March 2009,
<https://www.rfc-editor.org/info/rfc5426>. <https://www.rfc-editor.org/info/rfc5426>.
[RFC5848] Kelsey, J., Callas, J., and A. Clemm, "Signed Syslog [RFC5848] Kelsey, J., Callas, J., and A. Clemm, "Signed Syslog
Messages", RFC 5848, DOI 10.17487/RFC5848, May 2010, Messages", RFC 5848, DOI 10.17487/RFC5848, May 2010,
<https://www.rfc-editor.org/info/rfc5848>. <https://www.rfc-editor.org/info/rfc5848>.
[RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
and A. Bierman, Ed., "Network Configuration Protocol
(NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
<https://www.rfc-editor.org/info/rfc6241>.
[RFC6991] Schoenwaelder, J., Ed., "Common YANG Data Types", [RFC6991] Schoenwaelder, J., Ed., "Common YANG Data Types",
RFC 6991, DOI 10.17487/RFC6991, July 2013, RFC 6991, DOI 10.17487/RFC6991, July 2013,
<https://www.rfc-editor.org/info/rfc6991>. <https://www.rfc-editor.org/info/rfc6991>.
[RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language", [RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language",
RFC 7950, DOI 10.17487/RFC7950, August 2016, RFC 7950, DOI 10.17487/RFC7950, August 2016,
<https://www.rfc-editor.org/info/rfc7950>. <https://www.rfc-editor.org/info/rfc7950>.
[RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF
Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017,
<https://www.rfc-editor.org/info/rfc8040>.
[RFC8089] Kerwin, M., "The "file" URI Scheme", RFC 8089, [RFC8089] Kerwin, M., "The "file" URI Scheme", RFC 8089,
DOI 10.17487/RFC8089, February 2017, DOI 10.17487/RFC8089, February 2017,
<https://www.rfc-editor.org/info/rfc8089>. <https://www.rfc-editor.org/info/rfc8089>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>. May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC8341] Bierman, A. and M. Bjorklund, "Network Configuration [RFC8341] Bierman, A. and M. Bjorklund, "Network Configuration
Access Control Model", STD 91, RFC 8341, Access Control Model", STD 91, RFC 8341,
DOI 10.17487/RFC8341, March 2018, DOI 10.17487/RFC8341, March 2018,
<https://www.rfc-editor.org/info/rfc8341>. <https://www.rfc-editor.org/info/rfc8341>.
[RFC8343] Bjorklund, M., "A YANG Data Model for Interface [RFC8343] Bjorklund, M., "A YANG Data Model for Interface
Management", RFC 8343, DOI 10.17487/RFC8343, March 2018, Management", RFC 8343, DOI 10.17487/RFC8343, March 2018,
<https://www.rfc-editor.org/info/rfc8343>. <https://www.rfc-editor.org/info/rfc8343>.
[RFC8407] Bierman, A., "Guidelines for Authors and Reviewers of
Documents Containing YANG Data Models", BCP 216, RFC 8407,
DOI 10.17487/RFC8407, October 2018,
<https://www.rfc-editor.org/info/rfc8407>.
[RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol
Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
<https://www.rfc-editor.org/info/rfc8446>.
[RFC8525] Bierman, A., Bjorklund, M., Schoenwaelder, J., Watsen, K., [RFC8525] Bierman, A., Bjorklund, M., Schoenwaelder, J., Watsen, K.,
and R. Wilton, "YANG Library", RFC 8525, and R. Wilton, "YANG Library", RFC 8525,
DOI 10.17487/RFC8525, March 2019, DOI 10.17487/RFC8525, March 2019,
<https://www.rfc-editor.org/info/rfc8525>. <https://www.rfc-editor.org/info/rfc8525>.
[RFC9000] Iyengar, J., Ed. and M. Thomson, Ed., "QUIC: A UDP-Based [RFC9640] Watsen, K., "YANG Data Types and Groupings for
Multiplexed and Secure Transport", RFC 9000, Cryptography", RFC 9640, DOI 10.17487/RFC9640, October
DOI 10.17487/RFC9000, May 2021, 2024, <https://www.rfc-editor.org/info/rfc9640>.
<https://www.rfc-editor.org/info/rfc9000>.
[Std-1003.1-2008] [RFC9645] Watsen, K., "YANG Groupings for TLS Clients and TLS
Group, I. A. T. O., ""Chapter 9: Regular Expressions". The Servers", RFC 9645, DOI 10.17487/RFC9645, October 2024,
Open Group Base Specifications Issue 6, IEEE Std <https://www.rfc-editor.org/info/rfc9645>.
1003.1-2008, 2016 Edition.", September 2016,
<http://pubs.opengroup.org/onlinepubs/9699919799/>.
11.2. Informative References [Std-1003.1-2024]
The Open Group, ""Chapter 9: Regular Expressions" The Open
Group Base Specifications Issue 8, IEEE Std 1003.1-2024",
2024, <https://pubs.opengroup.org/onlinepubs/9799919799>.
[W3C.REC-xml-20081126]
Bray, T., Paoli, J., Sperberg-McQueen, C.M., Maler, E.,
and F. Yergeau, "Extensible Markup Language (XML) 1.0
(Fifth Edition)", World Wide Web Consortium
Recommendation REC-xml-20081126, November 2008,
<https://www.w3.org/TR/2008/REC-xml-20081126/>.
9.2. Informative References
[RFC4252] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH)
Authentication Protocol", RFC 4252, DOI 10.17487/RFC4252,
January 2006, <https://www.rfc-editor.org/info/rfc4252>.
[RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
and A. Bierman, Ed., "Network Configuration Protocol
(NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
<https://www.rfc-editor.org/info/rfc6241>.
[RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF
Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017,
<https://www.rfc-editor.org/info/rfc8040>.
[RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams", [RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams",
BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018, BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018,
<https://www.rfc-editor.org/info/rfc8340>. <https://www.rfc-editor.org/info/rfc8340>.
[RFC8342] Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K., [RFC8342] Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K.,
and R. Wilton, "Network Management Datastore Architecture and R. Wilton, "Network Management Datastore Architecture
(NMDA)", RFC 8342, DOI 10.17487/RFC8342, March 2018, (NMDA)", RFC 8342, DOI 10.17487/RFC8342, March 2018,
<https://www.rfc-editor.org/info/rfc8342>. <https://www.rfc-editor.org/info/rfc8342>.
[RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol
Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018,
<https://www.rfc-editor.org/info/rfc8446>.
[RFC9000] Iyengar, J., Ed. and M. Thomson, Ed., "QUIC: A UDP-Based
Multiplexed and Secure Transport", RFC 9000,
DOI 10.17487/RFC9000, May 2021,
<https://www.rfc-editor.org/info/rfc9000>.
[YANG-GUIDELINES]
Bierman, A., Boucadair, M., and Q. Wu, "Guidelines for
Authors and Reviewers of Documents Containing YANG Data
Models", Work in Progress, Internet-Draft, draft-ietf-
netmod-rfc8407bis-24, 18 April 2025,
<https://datatracker.ietf.org/doc/html/draft-ietf-netmod-
rfc8407bis-24>.
Appendix A. Tree Diagrams Appendix A. Tree Diagrams
A.1. Complete Tree Diagram A.1. Complete Tree Diagram
[note: '\' line wrapping for formatting only] [note: '\' line wrapping for formatting only]
module: ietf-syslog module: ietf-syslog
+--rw syslog! +--rw syslog!
+--rw actions +--rw actions
+--rw console! {console-action}? +--rw console! {console-action}?
skipping to change at page 37, line 33 skipping to change at line 1598
| +--rw port? | +--rw port?
| | inet:port-number | | inet:port-number
| +--rw client-identity! | +--rw client-identity!
| | +--rw (auth-type) | | +--rw (auth-type)
| | +--:(certificate) | | +--:(certificate)
| | | {client-ident-x509-cert}? | | | {client-ident-x509-cert}?
| | | +--rw certificate | | | +--rw certificate
| | | +--rw (inline-or-keystore) | | | +--rw (inline-or-keystore)
| | | +--:(inline) | | | +--:(inline)
| | | | {inline-definition\ | | | | {inline-definition\
s-s s-supported}?
upported}?
| | | | +--rw inline-definition | | | | +--rw inline-definition
| | | | +--rw public-key-form\ | | | | +--rw public-key-form\
at? at?
| | | | | identityref | | | | | identityref
| | | | +--rw public-key? | | | | +--rw public-key?
| | | | | binary | | | | | binary
| | | | +--rw private-key-for\ | | | | +--rw private-key-for\
mat mat?
?
| | | | | identityref | | | | | identityref
| | | | +--rw (private-key-ty\ | | | | +--rw (private-key-ty\
pe) pe)
| | | | | +--:(cleartext-pri\ | | | | | +--:(cleartext-pri\
vat vate-key)
e-key)
| | | | | | {cleartex\ | | | | | | {cleartex\
t-p t-private-keys}?
rivate-keys}?
| | | | | | +--rw cleartext\ | | | | | | +--rw cleartext\
-pr -private-key?
ivate-key?
| | | | | | binary | | | | | | binary
| | | | | +--:(hidden-privat\ | | | | | +--:(hidden-privat\
e-k e-key)
ey)
| | | | | | {hidden-p\ | | | | | | {hidden-p\
riv rivate-keys}?
ate-keys}?
| | | | | | +--rw hidden-pr\ | | | | | | +--rw hidden-pr\
iva ivate-key?
te-key?
| | | | | | empty | | | | | | empty
| | | | | +--:(encrypted-pri\ | | | | | +--:(encrypted-pri\
vat vate-key)
e-key)
| | | | | {encrypte\ | | | | | {encrypte\
d-p d-private-keys}?
rivate-keys}?
| | | | | +--rw encrypted\ | | | | | +--rw encrypted\
-pr -private-key
ivate-key
| | | | | +--rw encryp\ | | | | | +--rw encryp\
ted ted-by
-by
| | | | | +--rw encryp\ | | | | | +--rw encryp\
ted ted-value-format
-value-format
| | | | | | iden\ | | | | | | iden\
tit tityref
yref
| | | | | +--rw encryp\ | | | | | +--rw encryp\
ted ted-value
-value
| | | | | bina\ | | | | | bina\
ry ry
| | | | +--rw cert-data? | | | | +--rw cert-data?
| | | | | end-entity-ce\ | | | | | end-entity-ce\
rt- rt-cms
cms
| | | | +---n certificate-exp\ | | | | +---n certificate-exp\
ira iration
tion
| | | | | {certificate-\ | | | | | {certificate-\
exp expiration-notification}?
iration-notification}?
| | | | | +-- expiration-dat\ | | | | | +-- expiration-dat\
e e
| | | | | yang:date-\ | | | | | yang:date-\
and and-time
-time
| | | | +---x generate-csr | | | | +---x generate-csr
| | | | {csr-generati\ | | | | {csr-generati\
on} on}?
?
| | | | +---w input | | | | +---w input
| | | | | +---w csr-forma\ | | | | | +---w csr-forma\
t t
| | | | | | identit\ | | | | | | identit\
yre yref
f
| | | | | +---w csr-info | | | | | +---w csr-info
| | | | | csr-inf\ | | | | | csr-inf\
o o
| | | | +--ro output | | | | +--ro output
| | | | +--ro (csr-type\ | | | | +--ro (csr-type\
) )
| | | | +--:(p10-csr\ | | | | +--:(p10-csr\
) )
| | | | +--ro p10\ | | | | +--ro p10\
-cs -csr?
r?
| | | | p\ | | | | p\
10- 10-csr
csr
| | | +--:(central-keystore) | | | +--:(central-keystore)
| | | {central-keystore-\ | | | {central-keystore-\
sup supported,asymmetric-keys}?
ported,asymmetric-keys}?
| | | +--rw central-keystore-r\ | | | +--rw central-keystore-r\
efe eference
rence
| | | +--rw asymmetric-key?\ | | | +--rw asymmetric-key?\
| | | | ks:central-as\ | | | | ks:central-as\
ymm ymmetric-key-ref
etric-key-ref
| | | | {central-keys\ | | | | {central-keys\
tor tore-supported,asymmetric-keys}?
e-supported,asymmetric-keys}?
| | | +--rw certificate? | | | +--rw certificate?
| | | leafref | | | leafref
| | +--:(raw-public-key) | | +--:(raw-public-key)
| | | {client-ident-raw-public-ke\ | | | {client-ident-raw-public-ke\
y}? y}?
| | | +--rw raw-private-key | | | +--rw raw-private-key
| | | +--rw (inline-or-keystore) | | | +--rw (inline-or-keystore)
| | | +--:(inline) | | | +--:(inline)
| | | | {inline-definition\ | | | | {inline-definition\
s-s s-supported}?
upported}?
| | | | +--rw inline-definition | | | | +--rw inline-definition
| | | | +--rw public-key-form\ | | | | +--rw public-key-form\
at? at?
| | | | | identityref | | | | | identityref
| | | | +--rw public-key? | | | | +--rw public-key?
| | | | | binary | | | | | binary
| | | | +--rw private-key-for\ | | | | +--rw private-key-for\
mat mat?
?
| | | | | identityref | | | | | identityref
| | | | +--rw (private-key-ty\ | | | | +--rw (private-key-ty\
pe) pe)
| | | | +--:(cleartext-pri\ | | | | +--:(cleartext-pri\
vat vate-key)
e-key)
| | | | | {cleartex\ | | | | | {cleartex\
t-p t-private-keys}?
rivate-keys}?
| | | | | +--rw cleartext\ | | | | | +--rw cleartext\
-pr -private-key?
ivate-key?
| | | | | binary | | | | | binary
| | | | +--:(hidden-privat\ | | | | +--:(hidden-privat\
e-k e-key)
ey)
| | | | | {hidden-p\ | | | | | {hidden-p\
riv rivate-keys}?
ate-keys}?
| | | | | +--rw hidden-pr\ | | | | | +--rw hidden-pr\
iva ivate-key?
te-key?
| | | | | empty | | | | | empty
| | | | +--:(encrypted-pri\ | | | | +--:(encrypted-pri\
vat vate-key)
e-key)
| | | | {encrypte\ | | | | {encrypte\
d-p d-private-keys}?
rivate-keys}?
| | | | +--rw encrypted\ | | | | +--rw encrypted\
-pr -private-key
ivate-key
| | | | +--rw encryp\ | | | | +--rw encryp\
ted ted-by
-by
| | | | +--rw encryp\ | | | | +--rw encryp\
ted ted-value-format
-value-format
| | | | | iden\ | | | | | iden\
tit tityref
yref
| | | | +--rw encryp\ | | | | +--rw encryp\
ted ted-value
-value
| | | | bina\ | | | | bina\
ry ry
| | | +--:(central-keystore) | | | +--:(central-keystore)
| | | {central-keystore-\ | | | {central-keystore-\
sup supported,asymmetric-keys}?
ported,asymmetric-keys}?
| | | +--rw central-keystore-r\ | | | +--rw central-keystore-r\
efe eference?
rence?
| | | ks:central-asymm\ | | | ks:central-asymm\
etr etric-key-ref
ic-key-ref
| | +--:(tls12-psk) | | +--:(tls12-psk)
| | | {client-ident-tls12-psk}? | | | {client-ident-tls12-psk}?
| | | +--rw tls12-psk | | | +--rw tls12-psk
| | | +--rw (inline-or-keystore) | | | +--rw (inline-or-keystore)
| | | | +--:(inline) | | | | +--:(inline)
| | | | | {inline-definition\ | | | | | {inline-definition\
s-s s-supported}?
upported}?
| | | | | +--rw inline-definition | | | | | +--rw inline-definition
| | | | | +--rw key-format? | | | | | +--rw key-format?
| | | | | | identityref | | | | | | identityref
| | | | | +--rw (key-type) | | | | | +--rw (key-type)
| | | | | +--:(cleartext-sym\ | | | | | +--:(cleartext-sym\
met metric-key)
ric-key)
| | | | | | +--rw cleartext\ | | | | | | +--rw cleartext\
-sy -symmetric-key?
mmetric-key?
| | | | | | binary | | | | | | binary
| | | | | | {cleart\ | | | | | | {cleart\
ext ext-symmetric-keys}?
-symmetric-keys}?
| | | | | +--:(hidden-symmet\ | | | | | +--:(hidden-symmet\
ric ric-key)
-key)
| | | | | | {hidden-s\ | | | | | | {hidden-s\
ymm ymmetric-keys}?
etric-keys}?
| | | | | | +--rw hidden-sy\ | | | | | | +--rw hidden-sy\
mme mmetric-key?
tric-key?
| | | | | | empty | | | | | | empty
| | | | | +--:(encrypted-sym\ | | | | | +--:(encrypted-sym\
met metric-key)
ric-key)
| | | | | {encrypte\ | | | | | {encrypte\
d-s d-symmetric-keys}?
ymmetric-keys}?
| | | | | +--rw encrypted\ | | | | | +--rw encrypted\
-sy -symmetric-key
mmetric-key
| | | | | +--rw encryp\ | | | | | +--rw encryp\
ted ted-by
-by
| | | | | +--rw encryp\ | | | | | +--rw encryp\
ted ted-value-format
-value-format
| | | | | | iden\ | | | | | | iden\
tit tityref
yref
| | | | | +--rw encryp\ | | | | | +--rw encryp\
ted ted-value
-value
| | | | | bina\ | | | | | bina\
ry ry
| | | | +--:(central-keystore) | | | | +--:(central-keystore)
| | | | {central-keystore-\ | | | | {central-keystore-\
sup supported,symmetric-keys}?
ported,symmetric-keys}?
| | | | +--rw central-keystore-r\ | | | | +--rw central-keystore-r\
efe eference?
rence?
| | | | ks:central-symme\ | | | | ks:central-symme\
tri tric-key-ref
c-key-ref
| | | +--rw id? | | | +--rw id?
| | | string | | | string
| | +--:(tls13-epsk) | | +--:(tls13-epsk)
| | {client-ident-tls13-epsk}? | | {client-ident-tls13-epsk}?
| | +--rw tls13-epsk | | +--rw tls13-epsk
| | +--rw (inline-or-keystore) | | +--rw (inline-or-keystore)
| | | +--:(inline) | | | +--:(inline)
| | | | {inline-definition\ | | | | {inline-definition\
s-s s-supported}?
upported}?
| | | | +--rw inline-definition | | | | +--rw inline-definition
| | | | +--rw key-format? | | | | +--rw key-format?
| | | | | identityref | | | | | identityref
| | | | +--rw (key-type) | | | | +--rw (key-type)
| | | | +--:(cleartext-sym\ | | | | +--:(cleartext-sym\
met metric-key)
ric-key)
| | | | | +--rw cleartext\ | | | | | +--rw cleartext\
-sy -symmetric-key?
mmetric-key?
| | | | | binary | | | | | binary
| | | | | {cleart\ | | | | | {cleart\
ext ext-symmetric-keys}?
-symmetric-keys}?
| | | | +--:(hidden-symmet\ | | | | +--:(hidden-symmet\
ric ric-key)
-key)
| | | | | {hidden-s\ | | | | | {hidden-s\
ymm ymmetric-keys}?
etric-keys}?
| | | | | +--rw hidden-sy\ | | | | | +--rw hidden-sy\
mme mmetric-key?
tric-key?
| | | | | empty | | | | | empty
| | | | +--:(encrypted-sym\ | | | | +--:(encrypted-sym\
met metric-key)
ric-key)
| | | | {encrypte\ | | | | {encrypte\
d-s d-symmetric-keys}?
ymmetric-keys}?
| | | | +--rw encrypted\ | | | | +--rw encrypted\
-sy -symmetric-key
mmetric-key
| | | | +--rw encryp\ | | | | +--rw encryp\
ted ted-by
-by
| | | | +--rw encryp\ | | | | +--rw encryp\
ted ted-value-format
-value-format
| | | | | iden\ | | | | | iden\
tit tityref
yref
| | | | +--rw encryp\ | | | | +--rw encryp\
ted ted-value
-value
| | | | bina\ | | | | bina\
ry ry
| | | +--:(central-keystore) | | | +--:(central-keystore)
| | | {central-keystore-\ | | | {central-keystore-\
sup supported,symmetric-keys}?
ported,symmetric-keys}?
| | | +--rw central-keystore-r\ | | | +--rw central-keystore-r\
efe eference?
rence?
| | | ks:central-symme\ | | | ks:central-symme\
tri tric-key-ref
c-key-ref
| | +--rw external-identity | | +--rw external-identity
| | | string | | | string
| | +--rw hash? | | +--rw hash?
| | | tlscmn:epsk-supported-\ | | | tlscmn:epsk-supported-\
has hash
h
| | +--rw context? | | +--rw context?
| | | string | | | string
| | +--rw target-protocol? | | +--rw target-protocol?
| | | uint16 | | | uint16
| | +--rw target-kdf? | | +--rw target-kdf?
| | uint16 | | uint16
| +--rw server-authentication | +--rw server-authentication
| | +--rw ca-certs! {server-auth-x509-cert}\ | | +--rw ca-certs! {server-auth-x509-cert}\
? ?
| | | +--rw (inline-or-truststore) | | | +--rw (inline-or-truststore)
| | | +--:(inline) | | | +--:(inline)
| | | | {inline-definitions-supp\ | | | | {inline-definitions-supp\
ort orted}?
ed}?
| | | | +--rw inline-definition | | | | +--rw inline-definition
| | | | +--rw certificate* [name] | | | | +--rw certificate* [name]
| | | | +--rw name | | | | +--rw name
| | | | | string | | | | | string
| | | | +--rw cert-data | | | | +--rw cert-data
| | | | | trust-anchor-cer\ | | | | | trust-anchor-cer\
t-c t-cms
ms
| | | | +---n certificate-expira\ | | | | +---n certificate-expira\
tio tion
n
| | | | {certificate-exp\ | | | | {certificate-exp\
ira iration-notification}?
tion-notification}?
| | | | +-- expiration-date | | | | +-- expiration-date
| | | | yang:date-and\ | | | | yang:date-and\
-time
-ti
me
| | | +--:(central-truststore) | | | +--:(central-truststore)
| | | {central-truststore-supp\ | | | {central-truststore-supp\
ort orted,certificates}?
ed,certificates}?
| | | +--rw central-truststore-refer\ | | | +--rw central-truststore-refer\
enc ence?
e?
| | | ts:central-certificate\ | | | ts:central-certificate\
-ba -bag-ref
g-ref
| | +--rw ee-certs! {server-auth-x509-cert}\ | | +--rw ee-certs! {server-auth-x509-cert}\
? ?
| | | +--rw (inline-or-truststore) | | | +--rw (inline-or-truststore)
| | | +--:(inline) | | | +--:(inline)
| | | | {inline-definitions-supp\ | | | | {inline-definitions-supp\
ort orted}?
ed}?
| | | | +--rw inline-definition | | | | +--rw inline-definition
| | | | +--rw certificate* [name] | | | | +--rw certificate* [name]
| | | | +--rw name | | | | +--rw name
| | | | | string | | | | | string
| | | | +--rw cert-data | | | | +--rw cert-data
| | | | | trust-anchor-cer\ | | | | | trust-anchor-cer\
t-c t-cms
ms
| | | | +---n certificate-expira\ | | | | +---n certificate-expira\
tio tion
n
| | | | {certificate-exp\ | | | | {certificate-exp\
ira iration-notification}?
tion-notification}?
| | | | +-- expiration-date | | | | +-- expiration-date
| | | | yang:date-and\ | | | | yang:date-and\
-ti -time
me
| | | +--:(central-truststore) | | | +--:(central-truststore)
| | | {central-truststore-supp\ | | | {central-truststore-supp\
ort orted,certificates}?
ed,certificates}?
| | | +--rw central-truststore-refer\ | | | +--rw central-truststore-refer\
enc ence?
e?
| | | ts:central-certificate\ | | | ts:central-certificate\
-ba -bag-ref
g-ref
| | +--rw raw-public-keys! | | +--rw raw-public-keys!
| | | {server-auth-raw-public-key}? | | | {server-auth-raw-public-key}?
| | | +--rw (inline-or-truststore) | | | +--rw (inline-or-truststore)
| | | +--:(inline) | | | +--:(inline)
| | | | {inline-definitions-supp\ | | | | {inline-definitions-supp\
ort orted}?
ed}?
| | | | +--rw inline-definition | | | | +--rw inline-definition
| | | | +--rw public-key* [name] | | | | +--rw public-key* [name]
| | | | +--rw name | | | | +--rw name
| | | | | string | | | | | string
| | | | +--rw public-key-format | | | | +--rw public-key-format
| | | | | identityref | | | | | identityref
| | | | +--rw public-key | | | | +--rw public-key
| | | | binary | | | | binary
| | | +--:(central-truststore) | | | +--:(central-truststore)
| | | {central-truststore-supp\ | | | {central-truststore-supp\
ort orted,public-keys}?
ed,public-keys}?
| | | +--rw central-truststore-refer\ | | | +--rw central-truststore-refer\
enc ence?
e?
| | | ts:central-public-key-\ | | | ts:central-public-key-\
bag bag-ref
-ref
| | +--rw tls12-psks? empty | | +--rw tls12-psks? empty
| | | {server-auth-tls12-psk}? | | | {server-auth-tls12-psk}?
| | +--rw tls13-epsks? empty | | +--rw tls13-epsks? empty
| | {server-auth-tls13-epsk}? | | {server-auth-tls13-epsk}?
| +--rw hello-params {tlscmn:hello-params}? | +--rw hello-params {tlscmn:hello-params}?
| | +--rw tls-versions | | +--rw tls-versions
| | | +--rw min? identityref | | | +--rw min? identityref
| | | +--rw max? identityref | | | +--rw max? identityref
| | +--rw cipher-suites | | +--rw cipher-suites
| | +--rw cipher-suite* | | +--rw cipher-suite*
| | tlscsa:tls-cipher-suite-algo\ | | tlscsa:tls-cipher-suite-algo\
rit rithm
hm
| +--rw keepalives {tls-client-keepalives}? | +--rw keepalives {tls-client-keepalives}?
| +--rw peer-allowed-to-send? empty | +--rw peer-allowed-to-send? empty
| +--rw test-peer-aliveness! | +--rw test-peer-aliveness!
| +--rw max-wait? uint16 | +--rw max-wait? uint16
| +--rw max-attempts? uint8 | +--rw max-attempts? uint8
+--rw filter +--rw filter
| +--rw facility-list* [facility severity] | +--rw facility-list* [facility severity]
| +--rw facility union | +--rw facility union
| +--rw severity union | +--rw severity union
| +--rw advanced-compare {select-adv-compare}? | +--rw advanced-compare {select-adv-compare}?
skipping to change at page 47, line 42 skipping to change at line 1986
| | | +--rw encrypted-private-key | | | +--rw encrypted-private-key
| | | +--rw encrypted-by | | | +--rw encrypted-by
| | | +--rw encrypted-value-format | | | +--rw encrypted-value-format
| | | | identityref | | | | identityref
| | | +--rw encrypted-value | | | +--rw encrypted-value
| | | binary | | | binary
| | +--rw cert-data? | | +--rw cert-data?
| | | end-entity-cert-cms | | | end-entity-cert-cms
| | +---n certificate-expiration | | +---n certificate-expiration
| | | {certificate-expiration-notificati\ | | | {certificate-expiration-notificati\
on} on}?
?
| | | +-- expiration-date | | | +-- expiration-date
| | | yang:date-and-time | | | yang:date-and-time
| | +---x generate-csr {csr-generation}? | | +---x generate-csr {csr-generation}?
| | +---w input | | +---w input
| | | +---w csr-format identityref | | | +---w csr-format identityref
| | | +---w csr-info csr-info | | | +---w csr-info csr-info
| | +--ro output | | +--ro output
| | +--ro (csr-type) | | +--ro (csr-type)
| | +--:(p10-csr) | | +--:(p10-csr)
| | +--ro p10-csr? p10-csr | | +--ro p10-csr? p10-csr
skipping to change at page 48, line 21 skipping to change at line 2012
+--rw sig-number-resends? uint32 +--rw sig-number-resends? uint32
+--rw sig-resend-delay? uint32 +--rw sig-resend-delay? uint32
+--rw sig-resend-count? uint32 +--rw sig-resend-count? uint32
Appendix B. Implementer Guidelines Appendix B. Implementer Guidelines
B.1. Extending Facilities B.1. Extending Facilities
Many vendors extend the list of facilities available for logging in Many vendors extend the list of facilities available for logging in
their implementation. Additional facilities may not work with the their implementation. Additional facilities may not work with the
syslog protocol as defined in [RFC5424] and hence such facilities syslog protocol as defined in [RFC5424]. Thus, such facilities apply
apply for local syslog-like logging functionality. for local syslog-like logging functionality.
The following is an example that shows how additional facilities The following is an example that shows how additional facilities
could be added to the list of available facilities (in this example could be added to the list of available facilities (two facilities
two facilities are added): are added in this example):
[note: '\' line wrapping for formatting only]
module example-vendor-syslog-types { module example-vendor-syslog-types {
namespace "http://example.com/ns/vendor-syslog-types"; namespace "http://example.com/ns/vendor-syslog-types";
prefix vendor-syslogtypes; prefix vendor-syslogtypes;
import ietf-syslog { import ietf-syslog {
prefix syslog; prefix syslog;
} }
organization organization
"Example, Inc."; "Example, Inc.";
contact contact
"Example, Inc. "Example, Inc.
Customer Service Customer Service
E-mail: syslog-yang@example.com"; Email: syslog-yang@example.com";
description description
"This module contains a collection of vendor-specific YANG type "This module contains a collection of vendor-specific YANG type
definitions for SYSLOG."; definitions for Syslog.";
revision 2024-03-19 { revision 2025-03-03 {
description description
"Version 1.0"; "Version 1.0";
reference reference
"Vendor SYSLOG Types: SYSLOG YANG Model"; "Vendor Syslog Types: Syslog YANG Module";
} }
identity vendor_specific_type_1 { identity vendor_specific_type_1 {
base syslog:syslog-facility; base syslog:syslog-facility;
description description
"Adding vendor specific type 1 to syslog-facility"; "Adding vendor-specific type 1 to syslog-facility";
} }
identity vendor_specific_type_2 { identity vendor_specific_type_2 {
base syslog:syslog-facility; base syslog:syslog-facility;
description description
"Adding vendor specific type 2 to syslog-facility"; "Adding vendor-specific type 2 to syslog-facility";
} }
} }
B.2. Syslog Terminal Output B.2. Syslog Terminal Output
Terminal output with requirements more complex than the console Terminal output with requirements more complex than the console
subtree currently provides, are expected to be supported via vendor subtree currently provides are expected to be supported via vendor
extensions rather than handled via the file subtree. extensions rather than handled via the file subtree.
B.3. Syslog File Naming Convention B.3. Syslog File Naming Convention
The syslog/file/log-file/file-rotation container contains The syslog/file/log-file/file-rotation container contains
configuration parameters for syslog file rotation. This section configuration parameters for syslog file rotation. This section
describes how these fields might be used by an implementer to name describes how these fields might be used by an implementer to name
syslog files in a rotation process. This information is offered as syslog files in a rotation process. This information is offered as
an informative guide only. an informative guide only.
When an active syslog file with a name specified by log-file/name, When an active syslog file with a name specified by log-file/name
reaches log-file/max-file-size and/or syslog events arrive after the reaches log-file/max-file-size and/or syslog events arrive after the
period specified by log-file/rollover, the logging system can close period specified by log-file/rollover, the logging system can close
the file, can compress it, and can name the archive file <log-file/ the file, compress it, and name the archive file <log-file/
name>.0.gz. The logging system can then open a new active syslog name>.0.gz. The logging system can then open a new active syslog
file <log-file/name>. file <log-file/name>.
When the new syslog file reaches either of the size limits referenced When the new syslog file reaches either of the size limits referenced
above, <log-file/name>.0.gz can be renamed <log-file/name>.1.gz and above, <log-file/name>.0.gz can be renamed <log-file/name>.1.gz and
the new syslog file can be closed, compressed and renamed <log-file/ the new syslog file can be closed, compressed, and renamed <log-file/
name>.0.gz. Each time that a new syslog file is closed, each of the name>.0.gz. Each time that a new syslog file is closed, each of the
prior syslog archive files named <log-file/name>.<n>.gz can be prior syslog archive files named <log-file/name>.<n>.gz can be
renamed to <log-file/name>.<n + 1>.gz. renamed to <log-file/name>.<n + 1>.gz.
Removal of archive log files could occur when either or both: Removal of archive log files could occur when either or both:
- log-file/number-of-files specified - the logging system can create * log-file/number-of-files is specified. The logging system can
up to log-file/number-of-files syslog archive files after which, the create up to log-file/number-of-files syslog archive files, after
contents of the oldest archived file could be overwritten. which the contents of the oldest archived file could be
overwritten.
- log-file/retention specified - the logging system can remove those * log-file/retention is specified. The logging system can remove
syslog archive files whose file expiration time (file creation time those syslog archive files whose file expiration time (file
plus the specified log-file/retention time) is prior to the current creation time plus the specified log-file/retention time) is prior
time. to the current time.
Acknowledgements
The authors wish to thank the following who commented on this
proposal:
Andy Bierman, Martin Bjorklund, Alex Campbell, Alex Clemm, Francis
Dupont, Jim Gibson, Jeffrey Haas, Bob Harold, John Heasley, Giles
Heron, Lisa Huang, Mahesh Jethanandani, Warren Kumari, Jeffrey K
Lange, Jan Lindblad, Chris Lonvick, Alexey Melnikov, Kathleen
Moriarty, Tom Petch, Adam Roach, Juergen Schoenwaelder, Phil Shafer,
Yaron Sheffer, Jason Sterne, Peter Van Horne, Kent Watsen, Bert
Wijnen, Dale R Worley, and Aleksandr Zhdankin.
Authors' Addresses Authors' Addresses
Joe Clarke (editor) Joe Clarke (editor)
Cisco Cisco
United States of America United States of America
Email: jclarke@cisco.com Email: jclarke@cisco.com
Mahesh Jethanandani (editor) Mahesh Jethanandani (editor)
Kloud Services Kloud Services
 End of changes. 268 change blocks. 
1571 lines changed or deleted 1380 lines changed or added

This html diff was produced by rfcdiff 1.48.