rfc9742xml2.original.xml   rfc9742.xml 
<?xml version="1.0" encoding="US-ASCII"?> <?xml version='1.0' encoding='UTF-8'?>
<?rfc toc="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes" ?>
<?rfc compact="yes"?>
<?rfc subcompact="no"?>
<?rfc linkmailto="no" ?>
<?rfc editing="no" ?>
<?rfc comments="yes" ?>
<?rfc inline="yes"?>
<?rfc rfcedstyle="yes"?>
<?rfc-ext allow-markup-in-artwork="yes" ?>
<?rfc-ext include-index="no" ?>
<!--<?rfc strict="no"?> -->
<rfc
category="std"
docName="draft-ietf-netmod-syslog-model-33"
ipr="trust200902"
submissionType="IETF"
consensus="true">
<?rfc toc="yes"?>
<front>
<title abbrev="Syslog Management">A YANG Data Model for Syslog
Configuration</title>
<author fullname="Joe Clarke"
initials="J"
role="editor"
surname="Clarke">
<organization>Cisco</organization>
<address>
<postal>
<country>US</country>
</postal>
<email>jclarke@cisco.com</email>
</address>
</author>
<author fullname="Mahesh Jethanandani"
initials="M"
role="editor"
surname="Jethanandani">
<organization>Kloud Services</organization>
<address>
<postal>
<country>US</country>
</postal>
<email>mjethanandani@gmail.com</email>
</address>
</author>
<author fullname="Clyde Wildes" initials="C" role="editor" surname="Wildes">
<organization>Cisco Systems Inc.</organization>
<address>
<postal>
<street>170 West Tasman Drive</street>
<city>San Jose</city>
<region>CA</region>
<code>95134</code>
<country>US</country>
</postal>
<phone>+1 415 819-6111</phone>
<email>clyde@clydewildes.com</email>
</address>
</author>
<author fullname="Kiran Koushik" initials="K" role="editor" surname="Koushik
">
<organization>Verizon Wireless</organization>
<address>
<postal>
<street>500 W Dove Rd.</street>
<city>Southlake</city>
<region>TX</region>
<code>76092</code>
<country>US</country>
</postal>
<phone>+1 512 650-0210</phone>
<email>kirankoushik.agraharasreenivasa@verizonwireless.com</email>
</address>
</author>
<date/>
<area>General</area>
<workgroup>NETMOD WG</workgroup>
<abstract>
<t>
This document defines a YANG data model for the configuration
of a syslog process. It is intended that this model be used by
vendors who implement syslog collectors in their systems.
</t>
</abstract>
</front>
<middle>
<section title="Introduction">
<t>This document defines a YANG <xref target="RFC7950"/>
configuration
data model that may be used to configure the syslog feature running on a
system. YANG models can be used with network management protocols
such as NETCONF <xref target="RFC6241"/>
to install, manipulate, and
delete the configuration of network devices.</t>
<t>The data model makes use of the YANG "feature" construct which allows
implementations to support only those syslog features that lie within
their capabilities.</t>
<t>
This module can be used to configure the syslog application
conceptual layers as implemented on the syslog collector.
</t>
<t>Essentially, a syslog process receives messages (from the kernel,
processes, applications or other syslog processes) and processes them.
The processing may involve logging to a local file, and/or displaying on
console, and/or relaying to syslog processes on other machines. The
processing is determined by the "facility" that originated the message
and the "severity" assigned to the message by the facility.</t>
<t>Such definitions of syslog protocol are defined in
<xref target="RFC5424"/>
, and are used in this RFC.</t>
<t>The YANG model in this document conforms to the Network Management
Datastore Architecture defined in
[RFC8342].</t>
<section title="Requirements Language">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 <xref target="RFC2119"/>
<xref target="RFC8174"/>
when, and only
when, they appear in all capitals, as shown here.</t>
</section>
</section>
<section title="Terminology">
<t>
The following terms are used throughout this document:
</t>
<ul>
<li>
Originator: an "originator" refers to an entity that generates
syslog content to be carried in a message. The term is defined
in <xref target="RFC5424"/>
</li>
<li>
Relay: A "relay" is an entity that forwards syslog messages. It
accepts messages from originators or other relays and sends them
to collectors or other relays. The term is defined in <xref
target="RFC5424"/>
</li>
<li>
Collector: A "collector" gathers syslog content for
further analysis. The term is defined in <xref
target="RFC5424"/>.
</li>
<li>
Action: The term "action" refers to the processing that takes
place for each syslog message received.
</li>
</ul>
</section>
<section title="NMDA Compliance">
<t>The YANG model in this document conforms to the Network Management
Datastore Architecture defined in
<xref target="RFC8342"/>
.
</t>
</section>
<section title="Editorial Note (To be removed by RFC Editor)"> <!DOCTYPE rfc [
<t>This document contains many placeholder values that need to be <!ENTITY nbsp "&#160;">
replaced with finalized values at the time of publication. This note <!ENTITY zwsp "&#8203;">
summarizes all of the substitutions that are needed. No other RFC <!ENTITY nbhy "&#8209;">
Editor instructions are specified elsewhere in this document.</t> <!ENTITY wj "&#8288;">
]>
<t>Artwork in this document contains shorthand references to drafts in <rfc xmlns:xi="http://www.w3.org/2001/XInclude" category="std" docName="draft-ie
progress. Please apply the following replacements: <list style="symbols" tf-netmod-syslog-model-33" number="9742" obsoletes="" updates="" ipr="trust20090
> 2" submissionType="IETF" consensus="true" tocInclude="true" symRefs="true" sortR
<t> efs="true" version="3" xml:lang="en">
<spanx style="verb">I-D.ietf-netconf-crypto-types</spanx> --&gt;
the assigned RFC value for draft-ietf-netconf-crypto-types</t>
<t> <front>
<spanx style="verb">I-D.ietf-netconf-tls-client-server</spanx> <title abbrev="Syslog Management">A YANG Data Model for Syslog Management</ti
--&gt; the assigned RFC value for tle>
draft-ietf-netconf-tls-client-server</t> <seriesInfo name="RFC" value="9742"/>
<author fullname="Joe Clarke" initials="J" role="editor" surname="Clarke">
<organization>Cisco</organization>
<address>
<postal>
<country>United States of America</country>
</postal>
<email>jclarke@cisco.com</email>
</address>
</author>
<author fullname="Mahesh Jethanandani" initials="M" role="editor" surname="Je
thanandani">
<organization>Kloud Services</organization>
<address>
<postal>
<country>United States of America</country>
</postal>
<email>mjethanandani@gmail.com</email>
</address>
</author>
<author fullname="Clyde Wildes" initials="C" role="editor" surname="Wildes">
<organization>Cisco Systems Inc.</organization>
<address>
<postal>
<street>170 West Tasman Drive</street>
<city>San Jose</city>
<region>CA</region>
<code>95134</code>
<country>United States of America</country>
</postal>
<phone>+1 415 819-6111</phone>
<email>clyde@clydewildes.com</email>
</address>
</author>
<author fullname="Kiran Koushik" initials="K" role="editor" surname="Koushik"
>
<organization>Verizon Wireless</organization>
<address>
<postal>
<street>500 W Dove Rd.</street>
<city>Southlake</city>
<region>TX</region>
<code>76092</code>
<country>United States of America</country>
</postal>
<phone>+1 512 650-0210</phone>
<email>kirankoushik.agraharasreenivasa@verizonwireless.com</email>
</address>
</author>
<date month="April" year="2025"/>
<area>OPS</area>
<workgroup>netmod</workgroup>
<t> <abstract>
<spanx style="verb">zzzz</spanx> --&gt; the assigned RFC value <t>
for this draft</t> This document defines a YANG data model for the management of a syslog
</list> process. It is intended that this data model be used by vendors who implement
</t> syslog collectors in their systems.
</section> </t>
</abstract>
</front>
<middle>
<section>
<name>Introduction</name>
<t>This document defines a YANG <xref target="RFC7950"/> data model that
may be used to configure the syslog feature running on a system. YANG
data models can be used with network management protocols such as NETCONF
<xref target="RFC6241"/> to install, manipulate, and delete the
configuration of network devices.</t>
<t>The data model makes use of the YANG "feature" construct that allows
implementations to support only those syslog features that lie within
their capabilities.</t>
<t>
This module can be used to configure the syslog application
conceptual layers as implemented on the syslog collector.
</t>
<t>Essentially, a syslog process receives messages (from the kernel,
processes, applications, or other syslog processes) and processes them.
The processing may involve logging to a local file, displaying on
console, and/or relaying to syslog processes on other machines. The
process is determined by the "facility" that originated the message
and the "severity" assigned to the message by the facility.</t>
<t>Such definitions of syslog protocol are defined in
<xref target="RFC5424"/> and are used in this RFC.</t>
<t>The YANG data model in this document conforms to the Network Management
Datastore Architecture defined in <xref target="RFC8342"/>.</t>
<section>
<name>Requirements Language</name>
<t>
The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>",
"<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>",
"<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
"<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are
to be interpreted as described in BCP&nbsp;14 <xref target="RFC2119"/>
<xref target="RFC8174"/> when, and only when, they appear in all capitals,
as shown here.
</t>
</section>
</section>
<section>
<name>Terminology</name>
<t>
The following terms are used throughout this document:
</t>
<dl spacing="normal" newline="false">
<dt>Originator:</dt><dd>An "originator" refers to an entity that generates
syslog content to be carried in a message. The term is defined
in <xref target="RFC5424"/>.</dd>
<section title="Design of the Syslog Model"> <dt>Relay:</dt> <dd>A "relay" is an entity that forwards syslog messages. I
<t> t
The syslog model was designed by comparing various syslog features accepts messages from originators or other relays and sends them
implemented by various vendors' in different implementations. to collectors or other relays. The term is defined in <xref target="RFC5424
</t> "/>.</dd>
<t> <dt>Collector:</dt> <dd>A "collector" gathers syslog content for
The module defines leafs that are common across further analysis. The term is defined in <xref target="RFC5424"/>.</dd>
implementations. Its simple design is meant to offer maximum
flexibility. However, not all optional features defined in this
document are present in all vendor implementations. Vendors
therefore, need to use the feature statements to specify the
optional features they support. At the same time, vendors can
augment the model to add proprietary features. <xref
target="extending_facilities">Extending Facilities</xref> shows an
examples of how that can be realized.
</t>
<t>Syslog consists of originators and collectors. The following diagram <dt>Action:</dt> <dd>The term "action" refers to the process that takes
shows syslog messages flowing from originators, to collectors where place for each syslog message received.</dd>
filtering can take place.</t> </dl>
</section>
<section>
<name>NMDA Compliance</name>
<t>The YANG data model in this document conforms to the Network Management
Datastore Architecture (NMDA) defined in
<xref target="RFC8342"/>.
</t>
</section>
<section>
<name>Design of the Syslog Model</name>
<t>
The syslog model was designed by comparing various syslog features
implemented by various vendors in different implementations.
</t>
<t>
The module defines leafs that are common across
implementations. Its simple design is meant to offer maximum
flexibility. However, not all optional features defined in this
document are present in all vendor implementations. Therefore, vendors
need to use the feature statements to specify the
optional features they support. At the same time, vendors can
augment the model to add proprietary features. "Extending
Facilities" (<xref target="extending_facilities"/>) shows an
example of how that can be realized.
</t>
<t>Syslog consists of originators and collectors. The following diagram
shows the syslog processing flow from originators to collectors where
filtering can take place.</t>
<figure> <figure title="Syslog Processing Flow"><artwork name="Syslog Process Flow" a
<artwork align="left"><![CDATA[ lign="left"><![CDATA[
Originators Originators
+-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+
| Various | | OS | | | | Remote | | Various | | OS | | | | Remote |
| Components | | Kernel | | Line Cards | | Servers | | Components | | Kernel | | Line Cards | | Servers |
+-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+
+-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+
| SNMP | | Interface | | Standby | | Syslog | | SNMP | | Interface | | Standby | | Syslog |
| Events | | Events | | Supervisor | | Itself | | Events | | Events | | Supervisor | | Itself |
+-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+ +-------------+
| | | |
+----------------------------------------------------------------+ +----------------------------------------------------------------+
| |
| |
| |
| |
+-------------+--------------+ +-------------+--------------+
| | | | | |
v v v v v v
Collectors Collectors
+----------+ +----------+ +----------------+ +----------+ +----------+ +----------------+
| | | Log | |Remote Relay(s)/| | | | Log | |Remote Relay(s)/|
| Console | | File(s) | |Collector(s) | | Console | | File(s) | |Collector(s) |
+----------+ +----------+ +----------------+ +----------+ +----------+ +----------------+]]></artwork></figure>
]]> </artwork> <t>Collectors are configured using the leafs in the syslog model
"actions" container that correspond to each message collector:</t>
<postamble>Figure 1. Syslog Processing Flow</postamble> <ul spacing="normal">
</figure> <li>
<t>console</t>
<t>Collectors are configured using the leaves in the syslog model </li>
"actions" container which correspond to each message collector:</t> <li>
<t>log file(s)</t>
<t> </li>
<list style="empty"> <li>
<t>console</t> <t>remote relay(s)/collector(s)</t>
</li>
<t>log file(s)</t> </ul>
<t>remote relay(s)/collector(s)</t>
</list>
</t>
<t>Within each action, a selector is used to filter syslog messages. A
selector consists of a list of one or more filters specified by
facility-severity pairs, and, if supported via the select-match feature,
an optional regular expression pattern match that is performed on the <xre
f target="RFC5424"/>
field.</t>
<t>A syslog message is processed if: <figure>
<artwork><![CDATA[
There is an element of facility-list (F, S) where
the message facility matches F
and the message severity matches S
and/or the message text matches the regex pattern (if it
is present)
]]> </artwork>
</figure>
</t>
<t>The facility is one of a specific syslog-facility, or all
facilities.</t>
<t>
The model offers the ability to select a transport that a user
might want to use for a remote relay or collector. The choice
is between using UDP, or TLS based sessions. The user can
configure multiple relays or collectors, but they have to use
the same transport.
</t>
<t>The severity is one of type syslog-severity, all severities, or none.
None is a special case that can be used to disable a filter. When
filtering severity, the default comparison is that messages of the
specified severity and higher are selected to be logged. This is shown
in the model as "default equals-or-higher". This behavior can be altered
if the select-adv-compare feature is enabled to specify a compare
operation and an action. Compare operations are: "equals" to select
messages with this single severity, or "equals-or-higher" to select
messages of the specified severity and higher. Actions are used to log
the message, block the message, or stop the message from being logged.</t>
<t> <t>Within each action, a selector is used to filter syslog messages. A
Many vendors extend the list of facilities available for selector consists of a list of one or more filters specified by
logging in their implementation. An example is included in facility-severity pairs, and, if supported via the select-match
<xref target="extending_facilities">Extending feature, an optional regular expression pattern match that is
Facilities</xref>. performed on the MSG field described in <xref target="RFC5424" sectionFormat=
</t> "of" section="6.4"/>.</t>
<sourcecode type="pseudocode"><![CDATA[
A syslog message is processed if there is an element
of facility-list (F, S) where
the message facility matches F,
the message severity matches S,
and/or the message text matches the regex pattern (if it
is present)]]></sourcecode>
<section title="Syslog Module"> <t>The facility is one of a specific syslog-facility or all
<t> facilities.</t>
A simplified tree representation of the data model is used in <t>
this document. Please see <xref target="RFC8340"/> for tree The model offers the ability to select a transport that a user
diagram notation. might want to use for a remote relay or collector. The choice
</t> is between using UDP or TLS-based sessions. The user can
configure multiple relays or collectors, but they have to use
the same transport.
</t>
<t>The severity is one of type syslog-severity, all severities, or none.
None is a special case that can be used to disable a filter. When
filtering severity, the default comparison is that messages of the
specified severity and higher are selected to be logged. This is shown
in the model as "default equals-or-higher". This behavior can be altered
if the select-adv-compare feature is enabled to specify a compare
operation and an action. Compare operations are: "equals" to select
messages with this single severity, or "equals-or-higher" to select
messages of the specified severity and higher. Actions are used to log
the message, block the message, or stop the message from being logged.</t>
<t>
Many vendors extend the list of facilities available for
logging in their implementation. An example is included in "Extending Fac
ilities"
(<xref target="extending_facilities"/>).
</t>
<section>
<name>Syslog Module</name>
<t>
A simplified tree representation of the data model is shown in <xref
target="tree-diagram"/>. Please see <xref target="RFC8340"/> for tree
diagram notation.
</t>
<figure anchor="tree-diagram">
<name>Tree Diagram for Syslog Model</name>
<figure> <sourcecode type="yangtree"><![CDATA[
<name>Tree Diagram for Syslog Model</name>
<artwork><![CDATA[
module: ietf-syslog module: ietf-syslog
+--rw syslog! +--rw syslog!
+--rw actions +--rw actions
+--rw console! {console-action}? +--rw console! {console-action}?
| +--rw filter | +--rw filter
| | +--rw facility-list* [facility severity] | | +--rw facility-list* [facility severity]
| | +--rw facility union | | +--rw facility union
| | +--rw severity union | | +--rw severity union
| | +--rw advanced-compare {select-adv-compare}? | | +--rw advanced-compare {select-adv-compare}?
| | +--rw compare? enumeration | | +--rw compare? enumeration
| | +--rw action? identityref | | +--rw action? identityref
| +--rw pattern-match? string {select-match}? | +--rw pattern-match? string {select-match}?
+--rw file {file-action}? +--rw file {file-action}?
| +--rw log-file* [name] | +--rw log-file* [name]
| +--rw name inet:uri | +--rw name inet:uri
| +--rw filter | +--rw filter
| | +--rw facility-list* [facility severity] | | +--rw facility-list* [facility severity]
| | +--rw facility union | | +--rw facility union
| | +--rw severity union | | +--rw severity union
| | +--rw advanced-compare {select-adv-compare}? | | +--rw advanced-compare {select-adv-compare}?
| | +--rw compare? enumeration | | +--rw compare? enumeration
| | +--rw action? identityref | | +--rw action? identityref
| +--rw pattern-match? string {select-match}? | +--rw pattern-match? string {select-match}?
| +--rw structured-data? boolean {structured-data}? | +--rw structured-data? boolean {structured-data}?
| +--rw file-rotation | +--rw file-rotation
| +--rw number-of-files? uint32 {file-limit-size}? | +--rw number-of-files? uint32 {file-limit-size}?
| +--rw max-file-size? uint32 {file-limit-size}? | +--rw max-file-size? uint32 {file-limit-size}?
| +--rw rollover? uint32 | +--rw rollover? uint32
| | {file-limit-duration}? | | {file-limit-duration}?
| +--rw retention? uint32 | +--rw retention? uint32
| {file-limit-duration}? | {file-limit-duration}?
+--rw remote {remote-action}? +--rw remote {remote-action}?
+--rw destination* [name] +--rw destination* [name]
+--rw name string +--rw name string
+--rw (transport) +--rw (transport)
| +--:(udp) | +--:(udp)
| | +--rw udp | | +--rw udp
| | +--rw udp* [address] | | +--rw udp* [address]
| | +--rw address inet:host | | +--rw address inet:host
| | +--rw port? inet:port-number | | +--rw port? inet:port-number
| +--:(tls) | +--:(tls)
| +--rw tls | +--rw tls
| +--rw tls* [address] | +--rw tls* [address]
| +--rw address inet:host | +--rw address inet:host
| +--rw port? | +--rw port?
| | inet:port-number | | inet:port-number
| +--rw client-identity! | +--rw client-identity!
| | +--rw (auth-type) | | +--rw (auth-type)
| | ... | | ...
| +--rw server-authentication | +--rw server-authentication
| | +--rw ca-certs! {server-auth-x509-cert}? | | +--rw ca-certs! {server-auth-x509-cert}?
| | | ... | | | ...
| | +--rw ee-certs! {server-auth-x509-cert}? | | +--rw ee-certs! {server-auth-x509-cert}?
| | | ... | | | ...
| | +--rw raw-public-keys! | | +--rw raw-public-keys!
| | | {server-auth-raw-public-key}? | | | {server-auth-raw-public-key}?
| | | ... | | | ...
| | +--rw tls12-psks? empty | | +--rw tls12-psks? empty
| | | {server-auth-tls12-psk}? | | | {server-auth-tls12-psk}?
| | +--rw tls13-epsks? empty | | +--rw tls13-epsks? empty
| | {server-auth-tls13-epsk}? | | {server-auth-tls13-epsk}?
| +--rw hello-params {tlscmn:hello-params}? | +--rw hello-params {tlscmn:hello-params}?
| | +--rw tls-versions | | +--rw tls-versions
| | | ... | | | ...
| | +--rw cipher-suites | | +--rw cipher-suites
| | ... | | ...
| +--rw keepalives {tls-client-keepalives}? | +--rw keepalives {tls-client-keepalives}?
| +--rw peer-allowed-to-send? empty | +--rw peer-allowed-to-send? empty
| +--rw test-peer-aliveness! | +--rw test-peer-aliveness!
| ... | ...
+--rw filter +--rw filter
| +--rw facility-list* [facility severity] | +--rw facility-list* [facility severity]
| +--rw facility union | +--rw facility union
| +--rw severity union | +--rw severity union
| +--rw advanced-compare {select-adv-compare}? | +--rw advanced-compare {select-adv-compare}?
| +--rw compare? enumeration | +--rw compare? enumeration
| +--rw action? identityref | +--rw action? identityref
+--rw pattern-match? string {select-match}? +--rw pattern-match? string {select-match}?
+--rw structured-data? boolean {structured-data}? +--rw structured-data? boolean {structured-data}?
+--rw facility-override? identityref +--rw facility-override? identityref
+--rw source-interface? if:interface-ref +--rw source-interface? if:interface-ref
| {remote-source-interface}? | {remote-source-interface}?
+--rw signing! {signed-messages}? +--rw signing! {signed-messages}?
+--rw cert-signers +--rw cert-signers
+--rw cert-signer* [name] +--rw cert-signer* [name]
| +--rw name string | +--rw name string
| +--rw cert | +--rw cert
| | +--rw public-key-format? | | +--rw public-key-format?
| | | identityref | | | identityref
| | +--rw public-key? binary | | +--rw public-key? binary
| | +--rw private-key-format? | | +--rw private-key-format?
| | | identityref | | | identityref
| | +--rw (private-key-type) | | +--rw (private-key-type)
| | | +--:(cleartext-private-key) | | | +--:(cleartext-private-key)
| | | | {cleartext-private-keys}? | | | | {cleartext-private-keys}?
| | | | ... | | | | ...
| | | +--:(hidden-private-key) | | | +--:(hidden-private-key)
| | | | {hidden-private-keys}? | | | | {hidden-private-keys}?
| | | | ... | | | | ...
| | | +--:(encrypted-private-key) | | | +--:(encrypted-private-key)
| | | {encrypted-private-keys}? | | | {encrypted-private-keys}?
| | | ... | | | ...
| | +--rw cert-data? | | +--rw cert-data?
| | | end-entity-cert-cms | | | end-entity-cert-cms
| | +---n certificate-expiration | | +---n certificate-expiration
| | | {certificate-expiration-notification} | | | {certificate-expiration-notificati\
? on}?
| | | +-- expiration-date | | | +-- expiration-date
| | | yang:date-and-time | | | yang:date-and-time
| | +---x generate-csr {csr-generation}? | | +---x generate-csr {csr-generation}?
| | +---w input | | +---w input
| | | ... | | | ...
| | +--ro output | | +--ro output
| | ... | | ...
| +--rw hash-algorithm? enumeration | +--rw hash-algorithm? enumeration
+--rw cert-initial-repeat? uint32 +--rw cert-initial-repeat? uint32
+--rw cert-resend-delay? uint32 +--rw cert-resend-delay? uint32
+--rw cert-resend-count? uint32 +--rw cert-resend-count? uint32
+--rw sig-max-delay? uint32 +--rw sig-max-delay? uint32
+--rw sig-number-resends? uint32 +--rw sig-number-resends? uint32
+--rw sig-resend-delay? uint32 +--rw sig-resend-delay? uint32
+--rw sig-resend-count? uint32 +--rw sig-resend-count? uint32
]]></sourcecode>
]]> </figure>
</artwork> </section>
</figure> </section>
</section> <section>
<name>Syslog YANG Module</name>
</section> <section>
<name>The ietf-syslog Module</name>
<section title="Syslog YANG Module"> <t>
<section title="The ietf-syslog Module"> This module imports typedefs from <xref target="RFC6991"/>, <xref target="RFC
<t> 8343"/>, groupings from <xref target="RFC9640"/>, and <xref target="RFC9645"/>.
This module imports typedefs from <xref target="RFC6991"/>, <xref It references
target="RFC8343"/>, groupings from <xref <xref target="RFC5424"/>, <xref target="RFC5425"/>, <xref target="RFC5426"/>,
target="I-D.ietf-netconf-crypto-types"/>, and <xref <xref target="RFC5848"/>, <xref target="RFC8089"/>, <xref target="RFC8174"/>, a
target="I-D.ietf-netconf-tls-client-server"/>, and it references nd <xref target="Std-1003.1-2024"/>.
<xref target="RFC5424"/>, <xref target="RFC5425"/>, <xref </t>
target="RFC5426"/>, <xref target="RFC5848"/>, <xref
target="RFC8089"/>, <xref target="RFC8174"/>, and <xref
target="Std-1003.1-2008"/>.
</t>
<figure> <figure>
<name>Sylog YANG Model</name> <name>Syslog YANG Module</name>
<artwork><![CDATA[ <sourcecode type="yang" markers="true" name="ietf-syslog@2025-03-03.yan
<CODE BEGINS> file "ietf-syslog@2024-09-18.yang" g"><![CDATA[
module ietf-syslog { module ietf-syslog {
yang-version 1.1; yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-syslog"; namespace "urn:ietf:params:xml:ns:yang:ietf-syslog";
prefix syslog; prefix syslog;
import ietf-inet-types {
prefix inet;
reference
"RFC 6991: Common YANG Data Types";
}
import ietf-interfaces {
prefix if;
reference
"RFC 8343: A YANG Data Model for Interface Management";
}
import ietf-tls-client {
prefix tlsc;
reference
"I-D.ietf-netconf-tls-client-server:
YANG Groupings for TLS Clients and TLS Servers";
}
import ietf-crypto-types { import ietf-inet-types {
prefix ct; prefix inet;
reference reference
"I-D.ietf-netconf-crypto-types: YANG Data Types for "RFC 6991: Common YANG Data Types";
Cryptography"; }
} import ietf-interfaces {
prefix if;
reference
"RFC 8343: A YANG Data Model for Interface Management";
}
import ietf-tls-client {
prefix tlsc;
reference
"RFC 9645: YANG Groupings for TLS Clients and TLS Servers";
}
import ietf-crypto-types {
prefix ct;
reference
"RFC 9640: YANG Data Types and Groupings for Cryptography";
}
organization organization
"IETF NETMOD (Network Modeling) Working Group"; "IETF NETMOD (Network Modeling) Working Group";
contact contact
"WG Web: <https://datatracker.ietf.org/wg/netmod/> "WG Web: <https://datatracker.ietf.org/wg/netmod/>
WG List: <mailto:netmod@ietf.org> WG List: <mailto:netmod@ietf.org>
Editor: Mahesh Jethanandani Editor: Mahesh Jethanandani
<mailto:mjethanandani@gmail.com> <mailto:mjethanandani@gmail.com>
Editor: Joe Clarke Editor: Joe Clarke
<mailto:jclarke@cisco.com> <mailto:jclarke@cisco.com>
Editor: Kiran Agrahara Sreenivasa Editor: Kiran Agrahara Sreenivasa
<mailto:kirankoushik.agraharasreenivasa@verizonwireless.com> <mailto:kirankoushik.agraharasreenivasa@verizonwireless.com>
Editor: Clyde Wildes Editor: Clyde Wildes
<mailto:clyde@clydewildes.com>"; <mailto:clyde@clydewildes.com>";
description description
"This module contains a collection of YANG definitions "This module contains a collection of YANG definitions
for syslog configuration. for syslog management.
Copyright (c) 2024 IETF Trust and the persons identified as Copyright (c) 2025 IETF Trust and the persons identified as
authors of the code. All rights reserved. authors of the code. All rights reserved.
Redistribution and use in source and binary forms, with or Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject without modification, is permitted pursuant to, and subject
to the license terms contained in, the Revised BSD License to the license terms contained in, the Revised BSD License
set forth in Section 4.c of the IETF Trust's Legal set forth in Section 4.c of the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info). (https://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC zzzz This version of this YANG module is part of RFC 9742
(https://www.rfc-editor.org/info/rfczzzz); (https://www.rfc-editor.org/info/rfc9742);
see the RFC itself for full legal notices. see the RFC itself for full legal notices.
The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
are to be interpreted as described in BCP 14 (RFC 2119) are to be interpreted as described in BCP 14 (RFC 2119)
(RFC 8174) when, and only when, they appear in all capitals, (RFC 8174) when, and only when, they appear in all capitals,
as shown here."; as shown here.";
revision 2024-09-18 {
description
"Initial Revision";
reference
"RFC zzzz: Syslog YANG Model";
}
feature console-action {
description
"This feature indicates that the local console action is
supported.";
}
feature file-action {
description
"This feature indicates that the local file action is
supported.";
}
feature file-limit-size {
description
"This feature indicates that file logging resources
are managed using size and number limits.";
}
feature file-limit-duration {
description
"This feature indicates that file logging resources
are managed using time based limits.";
}
feature remote-action {
description
"This feature indicates that the remote server action is
supported.";
}
feature remote-source-interface {
description
"This feature indicates that source-interface is supported
supported for the remote-action.";
}
feature select-adv-compare {
description
"This feature represents the ability to select messages
using the additional comparison operators when comparing
the syslog message severity.";
}
feature select-match {
description
"This feature represents the ability to select messages
based on a Posix 1003.2 regular expression pattern
match.";
}
feature structured-data { revision 2025-03-03 {
description description
"This feature represents the ability to log messages "Initial Revision";
in structured-data format."; reference
reference "RFC 9742: Syslog YANG Module";
"RFC 5424: The Syslog Protocol"; }
}
feature signed-messages { feature console-action {
description description
"This feature represents the ability to configure signed "This feature indicates that the local console action is
syslog messages."; supported.";
reference }
"RFC 5848: Signed Syslog Messages";
}
typedef syslog-severity { feature file-action {
type enumeration { description
enum emergency { "This feature indicates that the local file action is
value 0; supported.";
description }
"The severity level 'Emergency' indicating that the
system is unusable.";
}
enum alert {
value 1;
description
"The severity level 'Alert' indicating that an
action must be taken immediately.";
}
enum critical {
value 2;
description
"The severity level 'Critical' indicating a
critical condition.";
}
enum error {
value 3;
description
"The severity level 'Error' indicating an error
condition.";
}
enum warning {
value 4;
description
"The severity level 'Warning' indicating a warning
condition.";
}
enum notice {
value 5;
description
"The severity level 'Notice' indicating a normal
but significant condition.";
}
enum info {
value 6;
description
"The severity level 'Info' indicating an
informational message.";
}
enum debug {
value 7;
description
"The severity level 'Debug' indicating a
debug-level message.";
}
}
description
"The definitions for Syslog message severity.
Note that a lower value is a higher severity. Comparisons
of equal-or-higher severity mean equal or lower numeric
value";
reference
"RFC 5424: The Syslog Protocol";
}
identity syslog-facility { feature file-limit-size {
description description
"This identity is used as a base for all syslog "This feature indicates that file logging resources
facilities."; are managed using size and number limits.";
reference }
"RFC 5424: The Syslog Protocol";
}
identity kern { feature file-limit-duration {
base syslog-facility; description
description "This feature indicates that file logging resources
"The facility for kernel messages (0)."; are managed using time based limits.";
reference }
"RFC 5424: The Syslog Protocol";
}
identity user { feature remote-action {
base syslog-facility; description
description "This feature indicates that the remote server action is
"The facility for user-level messages (1)."; supported.";
reference }
"RFC 5424: The Syslog Protocol";
}
identity mail { feature remote-source-interface {
base syslog-facility; description
description "This feature indicates that source-interface is supported
"The facility for the mail system (2)."; for the remote-action.";
reference }
"RFC 5424: The Syslog Protocol";
}
identity daemon { feature select-adv-compare {
base syslog-facility; description
description "This feature represents the ability to select messages
"The facility for the system daemons (3)."; using the additional comparison operators when comparing
reference the syslog message severity.";
"RFC 5424: The Syslog Protocol"; }
}
identity auth { feature select-match {
base syslog-facility; description
description "This feature represents the ability to select messages
"The facility for security/authorization messages (4)."; based on a Posix 1003.2 regular expression pattern
reference match.";
"RFC 5424: The Syslog Protocol"; }
}
identity syslog { feature structured-data {
base syslog-facility; description
description "This feature represents the ability to log messages
"The facility for messages generated internally by syslogd in structured-data format.";
facility (5)."; reference
reference "RFC 5424: The Syslog Protocol";
"RFC 5424: The Syslog Protocol"; }
}
identity lpr { feature signed-messages {
base syslog-facility; description
description "This feature represents the ability to configure signed
"The facility for the line printer subsystem (6)."; syslog messages.";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5848: Signed Syslog Messages";
} }
identity news { typedef syslog-severity {
base syslog-facility; type enumeration {
description enum emergency {
"The facility for the network news subsystem (7)."; value 0;
reference description
"RFC 5424: The Syslog Protocol"; "The severity level 'Emergency' indicates that the
} system is unusable.";
}
enum alert {
value 1;
description
"The severity level 'Alert' indicates that an
action must be taken immediately.";
}
enum critical {
value 2;
description
"The severity level 'Critical' indicates a
critical condition.";
}
enum error {
value 3;
description
"The severity level 'Error' indicates an error
condition.";
}
enum warning {
value 4;
description
"The severity level 'Warning' indicates a warning
condition.";
}
enum notice {
value 5;
description
"The severity level 'Notice' indicates a normal
but significant condition.";
}
enum info {
value 6;
description
"The severity level 'Info' indicates an
informational message.";
}
enum debug {
value 7;
description
"The severity level 'Debug' indicates a
debug-level message.";
}
}
description
"The definitions for Syslog message severity.
Note that a lower value is a higher severity. Comparisons
of equal-or-higher severity mean equal-or-lower numeric
value";
reference
"RFC 5424: The Syslog Protocol";
}
identity uucp { identity syslog-facility {
base syslog-facility; description
description "This identity is used as a base for all syslog
"The facility for the UUCP subsystem (8)."; facilities.";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol";
} }
identity cron { identity kern {
base syslog-facility; base syslog-facility;
description description
"The facility for the clock daemon (9)."; "The facility for kernel messages (numerical code 0).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity authpriv { identity user {
base syslog-facility; base syslog-facility;
description description
"The facility for privileged security/authorization "The facility for user-level messages (numerical code 1).";
messages (10)."; reference
reference "RFC 5424: The Syslog Protocol, Section 6.2.1.";
"RFC 5424: The Syslog Protocol"; }
}
identity ftp { identity mail {
base syslog-facility; base syslog-facility;
description description
"The facility for the FTP daemon (11)."; "The facility for the mail system (numerical code 2).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity ntp { identity daemon {
base syslog-facility; base syslog-facility;
description description
"The facility for the NTP subsystem (12)."; "The facility for the system daemons (numerical code 3).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity audit { identity auth {
base syslog-facility; base syslog-facility;
description description
"The facility for log audit messages (13)."; "The facility for security/authorization messages (numerical
reference code 4).";
"RFC 5424: The Syslog Protocol"; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity console { identity syslog {
base syslog-facility; base syslog-facility;
description description
"The facility for log alert messages (14)."; "The facility for messages generated internally by a syslog
reference daemon facility (numerical code 5).";
"RFC 5424: The Syslog Protocol"; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity cron2 { identity lpr {
base syslog-facility; base syslog-facility;
description description
"The facility for the second clock daemon (15)."; "The facility for the line printer subsystem (numerical code
reference 6).";
"RFC 5424: The Syslog Protocol"; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity local0 { identity news {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 0 messages (16)."; "The facility for the network news subsystem (numerical code
reference 7).";
"RFC 5424: The Syslog Protocol"; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity local1 { identity uucp {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 1 messages (17)."; "The facility for the Unix-to-Unix Copy (UUCP) subsystem
reference (numerical code 8).";
"RFC 5424: The Syslog Protocol"; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity local2 { identity cron {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 2 messages (18)."; "The facility for the clock daemon (numerical code 9).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity local3 { identity authpriv {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 3 messages (19)."; "The facility for privileged security/authorization messages
reference (numerical code 10).";
"RFC 5424: The Syslog Protocol"; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity local4 { identity ftp {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 4 messages (20)."; "The facility for the FTP daemon (numerical code 11).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity local5 { identity ntp {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 5 messages (21)."; "The facility for the NTP subsystem (numerical code 12).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity local6 { identity audit {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 6 messages (22)."; "The facility for log audit messages (numerical code 13).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity local7 { identity console {
base syslog-facility; base syslog-facility;
description description
"The facility for local use 7 messages (23)."; "The facility for log alert messages (numerical code 14).";
reference reference
"RFC 5424: The Syslog Protocol"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
identity action { identity cron2 {
description base syslog-facility;
"Base identity for action for how a message will be description
handled."; "The facility for the second clock daemon (numerical code
} 15).";
reference
"RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity log { identity local0 {
base action; base syslog-facility;
description description
"This identity specifies that if the compare operation is "The facility for local use 0 messages (numerical code 16).";
true the message will be logged."; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity block { identity local1 {
base action; base syslog-facility;
description description
"This identity specifies that if the compare operation is "The facility for local use 1 messages (numerical code 17).";
true the message will not be logged."; reference
} "RFC 5424: The Syslog Protocol, Section 6.2.1.";
}
identity stop { identity local2 {
base action; base syslog-facility;
description description
"This identity specifies that if the compare operation is "The facility for local use 2 messages (numerical code 18).";
true the message will not be logged and no further reference
processing will occur for it."; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
grouping severity-filter { identity local3 {
description base syslog-facility;
"This grouping defines the processing used to select description
log messages by comparing syslog message severity using "The facility for local use 3 messages (numerical code 19).";
the following processing rules: reference
- if 'none', do not match. "RFC 5424: The Syslog Protocol";
- if 'all', match. }
- else compare message severity with the specified
severity according to the default compare rule (all
messages of the specified severity and greater match)
or if the select-adv-compare feature is present, use
the advance-compare rule.";
leaf severity { identity local4 {
type union { base syslog-facility;
type syslog-severity; description
type enumeration { "The facility for local use 4 messages (numerical code 20).";
enum none { reference
value 2147483647; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
description }
"This enum describes the case where no
severities are selected.";
}
enum all {
value -2147483648;
description
"This enum describes the case where all
severities are selected.";
}
}
}
mandatory true;
description
"This leaf specifies the syslog message severity.";
}
container advanced-compare { identity local5 {
when "../severity != \"all\" and base syslog-facility;
../severity != \"none\"" { description
description "The facility for local use 5 messages (numerical code 21).";
"The advanced compare container is not applicable reference
for severity 'all' or severity 'none'"; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
if-feature "select-adv-compare";
leaf compare { identity local6 {
type enumeration { base syslog-facility;
enum equals { description
description "The facility for local use 6 messages (numerical code 22).";
"This enum specifies that the severity reference
comparison operation will be equals."; "RFC 5424: The Syslog Protocol, Section 6.2.1.";
} }
enum equals-or-higher {
description
"This enum specifies that the severity
comparison operation will be equals or
higher.";
}
}
default "equals-or-higher";
description
"The compare can be used to specify the comparison
operator that should be used to compare the syslog
message severity with the specified severity.";
}
leaf action { identity local7 {
type identityref { base syslog-facility;
base "action"; description
} "The facility for local use 7 messages (numerical code 23).";
default "log"; reference
description "RFC 5424: The Syslog Protocol, Section 6.2.1.";
"The action can be used to specify how the message }
should be handled. This may include logging the
message, not logging the message (i.e., blocking
it), or stopping further processing.";
}
description
"This container describes additional severity compare
operations that can be used in place of the default
severity comparison. The compare leaf specifies the
type of the compare that is done and the action leaf
specifies the intended result.
Example: compare->equals and action->block means
messages that have a severity that are equal to the
specified severity will not be logged.";
}
}
grouping selector { identity action {
description description
"This grouping defines a syslog selector which is used to "Base identity for action for how a message will be
select log messages for the log-actions (console, file, handled.";
remote, etc.). Choose one or both of the following: }
facility [<facility> <severity>...]
pattern-match regular-expression-match-string
If both facility and pattern-match are specified, both
must match in order for a log message to be selected.";
container filter { identity log {
description base action;
"This container describes the syslog filter description
parameters."; "This identity specifies that if the compare operation is
true, the message will be logged.";
}
list facility-list { identity block {
key "facility severity"; base action;
ordered-by user; description
description "This identity specifies that if the compare operation is
"This list describes a collection of syslog true, the message will not be logged.";
facilities and severities."; }
leaf facility { identity stop {
type union { base action;
type identityref { description
base syslog-facility; "This identity specifies that if the compare operation is
} true, the message will not be logged and no further
type enumeration { processing will occur for it.";
enum all { }
description
"This enum describes the case where
all facilities are requested.";
}
}
}
description
"The leaf uniquely identifies a syslog
facility.";
}
uses severity-filter;
}
}
leaf pattern-match { grouping severity-filter {
if-feature "select-match"; description
type string; "This grouping defines the processing used to select
description log messages by comparing syslog message severity using
"This leaf describes a Posix 1003.2 regular expression the following processing rules:
string that can be used to select a syslog message for - if 'none', do not match.
logging. The match is performed on the SYSLOG-MSG - if 'all', match.
field."; - else, compare message severity with the specified
reference severity according to the default compare rule (all
"RFC 5424: The Syslog Protocol messages of the specified severity and greater match)
Std-1003.1-2008 Regular Expressions"; or if the select-adv-compare feature is present, use
} the advance-compare rule.";
} leaf severity {
type union {
type syslog-severity;
type enumeration {
enum none {
value 2147483647;
description
"This enum describes the case where no
severities are selected.";
}
enum all {
value -2147483648;
description
"This enum describes the case where all
severities are selected.";
}
}
}
mandatory true;
description
"This leaf specifies the syslog message severity.";
}
container advanced-compare {
when "../severity != \"all\" and
../severity != \"none\"" {
description
"The advanced compare container is not applicable
for severity 'all' or severity 'none'";
}
if-feature "select-adv-compare";
leaf compare {
type enumeration {
enum equals {
description
"This enum specifies that the severity
comparison operation will be equals.";
}
enum equals-or-higher {
description
"This enum specifies that the severity
comparison operation will be equals or
higher.";
}
}
default "equals-or-higher";
description
"The compare operation can be used to specify the comparison
operator that should be used to compare the syslog
message severity with the specified severity.";
}
leaf action {
type identityref {
base action;
}
default "log";
description
"The action can be used to specify how the message
should be handled. This may include logging the
message, not logging the message (i.e., blocking
it), or stopping further processing.";
}
description
"This container describes additional severity compare
operations that can be used in place of the default
severity comparison. The compare leaf specifies the
type of compare operation that is done and the
action leaf specifies the intended result.
Example: compare->equals and action->block means
messages that have a severity that are equal to the
specified severity will not be logged.";
}
}
grouping structured-data { grouping selector {
description description
"This grouping defines the syslog structured data option "This grouping defines a syslog selector, which is used to
which is used to select the format used to write log select log messages for the log-actions (console, file,
messages."; remote, etc.). Choose one or both of the following:
facility [<facility> <severity>...]
pattern-match regular-expression-match-string
If both facility and pattern-match are specified, both
must match in order for a log message to be selected.";
container filter {
description
"This container describes the syslog filter
parameters.";
list facility-list {
key "facility severity";
ordered-by user;
description
"This list describes a collection of syslog
facilities and severities.";
leaf facility {
type union {
type identityref {
base syslog-facility;
}
type enumeration {
enum all {
description
"This enum describes the case where
all facilities are requested.";
}
}
}
description
"The leaf uniquely identifies a syslog
facility.";
}
uses severity-filter;
}
}
leaf pattern-match {
if-feature "select-match";
type string;
description
"This leaf describes a Posix 1003.2 regular expression
string that can be used to select a syslog message for
logging. The match is performed on the SYSLOG-MSG
field.";
reference
"RFC 5424: The Syslog Protocol
Std-1003.1-2024 Regular Expressions";
}
}
leaf structured-data { grouping structured-data {
if-feature "structured-data"; description
type boolean; "This grouping defines the syslog structured data option,
default "false"; which is used to select the format used to write log
description messages.";
"This leaf describes how log messages are written. leaf structured-data {
If true, messages will be written with one or more if-feature "structured-data";
STRUCTURED-DATA elements; if false, messages will be type boolean;
written with STRUCTURED-DATA = NILVALUE."; default "false";
reference description
"RFC 5424: The Syslog Protocol"; "This leaf describes how log messages are written.
} If true, messages will be written with one or more
} STRUCTURED-DATA elements; if false, messages will be
written with STRUCTURED-DATA = NILVALUE.";
reference
"RFC 5424: The Syslog Protocol";
}
}
container syslog { container syslog {
presence presence "Enables logging.";
"Enables logging."; description
description "This container describes the configuration parameters for
"This container describes the configuration parameters for
syslog."; syslog.";
container actions {
container actions { description
description "This container describes the log-action parameters
"This container describes the log-action parameters for syslog.";
for syslog."; container console {
if-feature "console-action";
container console { presence "Enables logging to the console";
if-feature "console-action"; description
presence "This container describes the configuration
"Enables logging to the console"; parameters for console logging.";
description uses selector;
"This container describes the configuration }
parameters for console logging."; container file {
uses selector; if-feature "file-action";
} description
"This container describes the configuration
container file { parameters for file logging. If file-archive
if-feature "file-action"; limits are not supplied, it is assumed that
description the local implementation defined limits will
"This container describes the configuration be used.";
parameters for file logging. If file-archive list log-file {
limits are not supplied, it is assumed that key "name";
the local implementation defined limits will description
be used."; "This list describes a collection of local
logging files.";
list log-file { leaf name {
key "name"; type inet:uri {
description pattern 'file:.*';
"This list describes a collection of local }
logging files."; description
"This leaf specifies the name of the log
leaf name { file, which MUST use the uri scheme
type inet:uri { file:.";
pattern reference
'file:.*'; "RFC 8089: The file URI Scheme";
} }
description uses selector;
"This leaf specifies the name of the log uses structured-data;
file which MUST use the uri scheme container file-rotation {
file:."; description
reference "This container describes the configuration
"RFC 8089: The file URI Scheme"; parameters for log file rotation.";
} leaf number-of-files {
if-feature "file-limit-size";
uses selector; type uint32;
uses structured-data; default "1";
description
container file-rotation { "This leaf specifies the maximum number
description of log files retained. Specify 1 for
"This container describes the configuration implementations that only support one
parameters for log file rotation."; log file.";
leaf number-of-files { }
if-feature "file-limit-size"; leaf max-file-size {
type uint32; if-feature "file-limit-size";
default "1"; type uint32;
description units "megabytes";
"This leaf specifies the maximum number description
of log files retained. Specify 1 for "This leaf specifies the maximum log
implementations that only support one file size.";
log file."; }
} leaf rollover {
if-feature "file-limit-duration";
leaf max-file-size { type uint32;
if-feature "file-limit-size"; units "minutes";
type uint32; description
units "megabytes"; "This leaf specifies the length of time
description that log events should be written to a
"This leaf specifies the maximum log specific log file. Log events that
file size."; arrive after the rollover period cause
} the current log file to be closed and
a new log file to be opened.";
leaf rollover { }
if-feature "file-limit-duration"; leaf retention {
type uint32; if-feature "file-limit-duration";
units "minutes"; type uint32;
description units "minutes";
"This leaf specifies the length of time description
that log events should be written to a "This leaf specifies the length of time
specific log file. Log events that that completed/closed log event files
arrive after the rollover period cause should be stored in the file system
the current log file to be closed and before they are removed.";
a new log file to be opened."; }
} }
}
leaf retention { }
if-feature "file-limit-duration"; container remote {
type uint32; if-feature "remote-action";
units "minutes"; description
description "This container describes the configuration
"This leaf specifies the length of time parameters for forwarding syslog messages
that completed/closed log event files to remote relays or collectors.";
should be stored in the file system list destination {
before they are removed."; key "name";
} description
} "This list describes a collection of remote logging
} destinations.";
} leaf name {
type string;
container remote { description
if-feature "remote-action"; "An arbitrary name for the endpoint to connect to.";
description }
"This container describes the configuration choice transport {
parameters for forwarding syslog messages mandatory true;
to remote relays or collectors."; description
"This choice describes the transport option.";
list destination { case udp {
key "name"; container udp {
description description
"This list describes a collection of remote logging "This container describes the UDP transport
destinations."; options.";
leaf name { reference
type string; "RFC 5426: Transmission of Syslog Messages over
description UDP";
"An arbitrary name for the endpoint to connect to."; list udp {
} key "address";
description
choice transport { "List of all UDP sessions.";
mandatory true; leaf address {
description type inet:host;
"This choice describes the transport option."; description
"The leaf uniquely specifies the address of the
case udp {
container udp {
description
"This container describes the UDP transport
options.";
reference
"RFC 5426: Transmission of Syslog Messages over
UDP";
list udp {
key "address";
description
"List of all UDP sessions.";
leaf address {
type inet:host;
description
"The leaf uniquely specifies the address of the
remote host. One of the following must be remote host. One of the following must be
specified: specified:
- an ipv4 address, - an ipv4 address,
- an ipv6 address, or a - an ipv6 address, or a
- host name."; - host name.";
} }
leaf port {
leaf port { type inet:port-number;
type inet:port-number; default "514";
default "514"; description
description "This leaf specifies the port number used to
"This leaf specifies the port number used to
deliver messages to the remote server."; deliver messages to the remote server.";
} }
} }
} }
} }
case tls {
case tls { container tls {
container tls { description
description "This container describes the TLS transport
"This container describes the TLS transport options.";
options."; reference
reference "RFC 5425: Transport Layer Security (TLS) Transport
"RFC 5425: Transport Layer Security (TLS) Transport Mapping for Syslog ";
Mapping for Syslog "; list tls {
key "address";
list tls { description
key "address"; "List of all TLS-based sessions.";
description leaf address {
"List of all TLS based sessions."; type inet:host;
description
leaf address { "The leaf uniquely specifies the address of the
type inet:host; remote host. One of the following must be
description specified: an ipv4 address, an ipv6 address,
"The leaf uniquely specifies the address of the or a host name.";
remote host. One of the following must be }
specified: an ipv4 address, an ipv6 address, or leaf port {
a host name."; type inet:port-number;
} default "6514";
description
leaf port { "TCP port 6514 has been allocated as the
type inet:port-number; default port for syslog over TLS.";
default "6514"; }
description uses tlsc:tls-client-grouping;
"TCP port 6514 has been allocated as the }
default port for syslog over TLS."; }
} }
uses tlsc:tls-client-grouping; }
} uses selector;
} uses structured-data;
} leaf facility-override {
} type identityref {
base syslog-facility;
uses selector; }
uses structured-data; description
"If specified, this leaf specifies the facility used
leaf facility-override { to override the facility in messages delivered to the
type identityref { remote server.";
base syslog-facility; }
} leaf source-interface {
description if-feature "remote-source-interface";
"If specified, this leaf specifies the facility used type if:interface-ref;
to override the facility in messages delivered to the description
remote server."; "This leaf sets the source interface to be used to
} send messages to the remote syslog server. If not set,
messages can be sent on any interface.";
leaf source-interface { }
if-feature "remote-source-interface"; container signing {
type if:interface-ref; if-feature "signed-messages";
description presence "If present, syslog-signing options is
"This leaf sets the source interface to be used to activated.";
send messages to the remote syslog server. If not set, description
messages can be sent on any interface."; "This container describes the configuration
} parameters for signed syslog messages.";
reference
container signing { "RFC 5848: Signed Syslog Messages";
if-feature "signed-messages"; container cert-signers {
presence description
"If present, syslog-signing options is activated."; "This container describes the signing certificate
description configuration for Signature Group 0, which covers
"This container describes the configuration the case for administrators who want all Signature
parameters for signed syslog messages."; Blocks to be sent to a single destination.";
reference list cert-signer {
"RFC 5848: Signed Syslog Messages"; key "name";
description
container cert-signers { "This list describes a collection of syslog message
description signers.";
"This container describes the signing certificate leaf name {
configuration for Signature Group 0 which covers the type string;
case for administrators who want all Signature description
Blocks to be sent to a single destination."; "This leaf specifies the name of the syslog
message signer.";
list cert-signer { }
key "name"; container cert {
description uses ct:asymmetric-key-pair-with-cert-grouping;
"This list describes a collection of syslog message description
signers."; "This is the certificate that is periodically
sent to the remote receiver. The certificate is
leaf name { inherently associated with its private
type string; and public keys.";
description }
"This leaf specifies the name of the syslog leaf hash-algorithm {
message signer."; type enumeration {
} enum SHA1 {
value 1;
container cert { description
uses ct:asymmetric-key-pair-with-cert-grouping; "This enum describes the SHA1 algorithm.";
description }
"This is the certificate that is periodically enum SHA256 {
sent to the remote receiver. The certificate is value 2;
inherently associated with its private description
and public keys."; "This enum describes the SHA256 algorithm.";
} }
}
leaf hash-algorithm { description
type enumeration { "This leaf describes the syslog signer hash
enum SHA1 { algorithm used.";
value 1; }
description }
"This enum describes the SHA1 algorithm."; leaf cert-initial-repeat {
} type uint32;
enum SHA256 { default "3";
value 2; description
description "This leaf specifies the number of times each
"This enum describes the SHA256 algorithm."; Certificate Block should be sent before the first
} message is sent.";
} }
description leaf cert-resend-delay {
"This leaf describes the syslog signer hash type uint32;
algorithm used."; units "seconds";
} default "3600";
} description
"This leaf specifies the maximum time delay in
leaf cert-initial-repeat { seconds until resending the Certificate Block.";
type uint32; }
default "3"; leaf cert-resend-count {
description type uint32;
"This leaf specifies the number of times each default "0";
Certificate Block should be sent before the first description
message is sent."; "This leaf specifies the maximum number of other
} syslog messages to send until resending the
Certificate Block.";
leaf cert-resend-delay { }
type uint32; leaf sig-max-delay {
units "seconds"; type uint32;
default "3600"; units "seconds";
description default "60";
"This leaf specifies the maximum time delay in description
seconds until resending the Certificate Block."; "This leaf specifies when to generate a new
} Signature Block. If this many seconds have elapsed
since the message with the first message number
leaf cert-resend-count { of the Signature Block was sent, a new Signature
type uint32; Block should be generated.";
default "0"; }
description leaf sig-number-resends {
"This leaf specifies the maximum number of other type uint32;
syslog messages to send until resending the default "0";
Certificate Block."; description
} "This leaf specifies the number of times a
Signature Block is resent. (It is recommended to
leaf sig-max-delay { select a value of greater than 0 in particular
type uint32; when the UDP transport as in RFC 5426 is used.)";
units "seconds"; }
default "60"; leaf sig-resend-delay {
description type uint32;
"This leaf specifies when to generate a new units "seconds";
Signature Block. If this many seconds have elapsed default "5";
since the message with the first message number description
of the Signature Block was sent, a new Signature "This leaf specifies when to send the next
Block should be generated."; Signature Block transmission based on time. If
} this many seconds have elapsed since the previous
sending of this Signature Block, resend it.";
leaf sig-number-resends { }
type uint32; leaf sig-resend-count {
default "0"; type uint32;
description default "0";
"This leaf specifies the number of times a description
Signature Block is resent. (It is recommended to "This leaf specifies when to send the next
select a value of greater than 0 in particular Signature Block transmission based on a count.
when the UDP transport RFC 5426 is used.)."; If this many other syslog messages have been sent
} since the previous sending of this Signature
Block, resend it. A value of 0 means that you
leaf sig-resend-delay { don't resend based on the number of messages.";
type uint32; }
units "seconds"; }
default "5"; }
description }
"This leaf specifies when to send the next }
Signature Block transmission based on time. If }
this many seconds have elapsed since the previous }
sending of this Signature Block, resend it.";
}
leaf sig-resend-count {
type uint32;
default "0";
description
"This leaf specifies when to send the next
Signature Block transmission based on a count. If
this many other syslog messages have been sent
since the previous sending of this Signature
Block, resend it. A value of 0 means that you
don't resend based on the number of messages.";
}
}
}
}
}
}
}
} }
<CODE ENDS> ]]></sourcecode>
</figure>
]]></artwork> </section>
</section>
</figure> <section>
</section> <name>Usage Examples</name>
</section> <t>The following examples are in XML <xref target="W3C.REC-xml-20081126"/>.</t>
<section>
<section title="Usage Examples"> <name>Syslog Configuration for Severity Critical</name>
<section title="Syslog Configuration for Severity Critical"> <t>This example shows how the console logging of syslog of severity critical can
<figure> be enabled.</t>
<name>Syslog Configuration for Severity Critical</name> <figure>
<artwork><![CDATA[ <name>Syslog Configuration for Severity Critical</name>
[note: '\' line wrapping for formatting only] <sourcecode type="xml"><![CDATA[
<!--
Enable console logging of syslogs of severity critical
<?xml version="1.0" encoding="UTF-8"?> <?xml version="1.0" encoding="UTF-8"?>
<syslog xmlns="urn:ietf:params:xml:ns:yang:ietf-syslog"> <syslog xmlns="urn:ietf:params:xml:ns:yang:ietf-syslog">
<actions> <actions>
<console> <console>
<filter> <filter>
<facility-list> <facility-list>
<facility>all</facility> <facility>all</facility>
<severity>critical</severity> <severity>critical</severity>
</facility-list> </facility-list>
</filter> </filter>
</console> </console>
</actions> </actions>
</syslog> </syslog>]]></sourcecode>
</figure>
]]></artwork> </section>
<section>
</figure> <name>Remote Syslog Configuration</name>
</section> <t>This example shows how the remote logging of syslogs to UDP destination
<section title="Remote Syslog Configuration"> foo.example.com for facility auth and severity error can be enabled.</t>
<figure> <figure>
<name>Remote Syslog Configuration</name> <name>Remote Syslog Configuration</name>
<artwork><![CDATA[ <sourcecode type="xml"><![CDATA[
[note: '\' line wrapping for formatting only]
<!--
Enable remote logging of syslogs to udp destination
foo.example.com for facility auth, severity error
<?xml version="1.0" encoding="UTF-8"?> <?xml version="1.0" encoding="UTF-8"?>
<syslog xmlns="urn:ietf:params:xml:ns:yang:ietf-syslog"> <syslog xmlns="urn:ietf:params:xml:ns:yang:ietf-syslog">
<actions> <actions>
<remote> <remote>
<destination> <destination>
<name>remote1</name> <name>remote1</name>
<udp> <udp>
<udp> <udp>
<address>foo.example.com</address> <address>foo.example.com</address>
</udp> </udp>
</udp> </udp>
<filter> <filter>
<facility-list> <facility-list>
<facility>auth</facility> <facility>auth</facility>
<severity>error</severity> <severity>error</severity>
</facility-list> </facility-list>
</filter> </filter>
</destination> </destination>
</remote> </remote>
</actions> </actions>
</syslog> </syslog>]]></sourcecode>
</figure>
]]></artwork> </section>
</section>
</figure> <section anchor="IANA">
</section> <name>IANA Considerations</name>
</section> <section>
<name>The IETF XML Registry</name>
<section anchor="Acknowledgements" title="Acknowledgements"> <t>This document registers one URI in the "IETF XML Registry", following
<t>The authors wish to thank the following who commented on this the format defined in <xref target="RFC3688"/>:</t>
proposal:</t> <dl newline="false" spacing="compact">
<dt>URI:</dt><dd>urn:ietf:params:xml:ns:yang:ietf-syslog</dd>
<t>Andy Bierman, Martin Bjorklund, Alex Campbell, Alex Clemm, <dt>Registrant Contact:</dt><dd>The IESG.</dd>
Francis Dupont, Jim Gibson, Jeffrey Haas, Bob Harold, John <dt>XML:</dt><dd>N/A; the requested URI is an XML namespace.</dd>
Heasley, Giles Heron, Lisa Huang, Mahesh Jethanandani, Warren </dl>
Kumari, Jeffrey K Lange, Jan Lindblad, Chris Lonvick, Alexey
Melnikov, Kathleen Moriarty, Tom Petch, Adam Roach, Juergen
Schoenwaelder, Phil Shafer, Yaron Sheffer, Jason Sterne, Peter
Van Horne, Kent Watsen, Bert Wijnen, Dale R Worley, and
Aleksandr Zhdankin.</t>
</section>
<!-- Possibly a 'Contributors' section ... -->
<section anchor="IANA" title="IANA Considerations">
<section title="The IETF XML Registry">
<t>This document registers one URI in the IETF XML registry <xref target="RFC368
8"/>
.
Following the format in <xref target="RFC3688"/>
,
the following registration is requested:</t>
<t>
<figure>
<artwork><![CDATA[
URI: urn:ietf:params:xml:ns:yang:ietf-syslog
Registrant Contact: The IESG.
XML: N/A, the requested URI is an XML namespace.
]]></artwork>
</figure>
</t>
</section>
<section title="The YANG Module Names Registry">
<t>This document registers one YANG module in the YANG Module Names
registry <xref target="RFC8525"/>
. Following the format in <xref target="RFC7950"/>
,
the following registration is requested:</t>
<t>
<figure>
<artwork><![CDATA[
name: ietf-syslog
namespace: urn:ietf:params:xml:ns:yang:ietf-syslog
prefix: syslog
reference: RFC zzzz
]]></artwork>
</figure>
</t>
</section>
</section>
<section title="Security Considerations">
<t>
This section is modeled after the template defined in <xref
section="3.7.1" target="RFC8407"/>.
</t>
<t>
The "ietf-syslog" YANG module specified in this document defines a
data model that is designed to be accessed via YANG-based
management protocols such as NETCONF <xref target="RFC6241"/> and
RESTCONF <xref target="RFC8040"/>. These protocols have
mandatory-to-implement secure transport layers (e.g., Secure Shell
(SSH) <xref target="RFC4252"/>, TLS <xref target="RFC8446"/>, and
QUIC <xref target="RFC9000"/>) and mandatory-to-implement mutual
authentication.
</t>
<t>
The NETCONF access control model <xref target="RFC8341"/> provides
the means to restrict access for particular NETCONF or RESTCONF
users to a preconfigured subset of all available NETCONF or
RESTCONF protocol operations and content.
</t>
<t>
This module imports groupings from ietf-crypto-types YANG module
defined in <xref target="I-D.ietf-netconf-crypto-types">YANG
Groupings for Crypto Types</xref>. Security considerations
described in that document apply to this module also.
</t>
<t>
There are a number of data nodes defined in this YANG module that
are writable/creatable/deletable (i.e., config true, which is the
default). These data nodes should be considered sensitive or
vulnerable in all network environments. Logging in particular is
used to assess the state of systems and can be used to indicate a
network compromise. If logging were to be disabled through
malicious means, attacks may not be readily detectable. Therefore
write operations (e.g., edit-config) to these data nodes without
proper protection can have a negative effect on network operations
and on network security.
</t>
<t>
In addition there are data nodes that require careful analysis and
review. These are the subtrees and data nodes and their
sensitivity/vulnerability:
<list hangIndent="6" style="hanging">
<t hangText=" facility-filter/pattern-match:">When writing
this node, implementations MUST ensure that the regular
expression pattern match is not constructed to cause a regular
expression denial of service attack due to a pattern that
causes the regular expression implementation to work very
slowly (exponentially related to input size).
</t>
<t hangText=" remote/destination/signing/cert-signer:">When
writing this subtree, implementations MUST NOT specify a
private key that is used for any other purpose.</t>
</list>
</t>
<t>
Some of the readable data nodes in this YANG module may be
considered sensitive or vulnerable in some network
environments. It is thus important to control read access (e.g.,
via get, get-config, or notification) to these data nodes. These
are the subtrees and data nodes and their
sensitivity/vulnerability:
<list hangIndent="6" style="hanging">
<t hangText=" remote/destination/transport:">This subtree
contains information about other hosts in the network, the
services available on those hosts, and the TLS transport
certificate properties if TLS is selected as the transport
protocol. Knowing that a service like syslog (udp/514) is
enabled on the host, will allow a malicious user to spam the
host on that port.
</t>
<t hangText=" remote/destination/signing:">This subtree contains
information about the syslog message signing properties
including signing certificate information.
</t>
</list>
</t>
<t>
There are no RPC operations defined in this YANG module.
</t>
</section>
</middle>
<back>
<references title="Normative References">
<?rfc include="reference.I-D.ietf-netconf-crypto-types.xml"?>
<?rfc include="reference.I-D.ietf-netconf-tls-client-server.xml"?>
<?rfc include="reference.RFC.8343.xml"?>
<?rfc include="reference.RFC.2119.xml"?>
<?rfc include="reference.RFC.3688.xml"?>
<?rfc include="reference.RFC.4252.xml"?>
<?rfc include="reference.RFC.5424.xml"?>
<?rfc include="reference.RFC.5425.xml"?>
<?rfc include="reference.RFC.5426.xml"?>
<?rfc include="reference.RFC.5848.xml"?>
<?rfc include="reference.RFC.6241.xml"?>
<?rfc include="reference.RFC.6991.xml"?>
<?rfc include="reference.RFC.8525.xml"?>
<?rfc include="reference.RFC.7950.xml"?>
<?rfc include="reference.RFC.8040.xml"?>
<?rfc include="reference.RFC.8089.xml"?>
<?rfc include="reference.RFC.8174.xml"?>
<?rfc include="reference.RFC.8407.xml"?>
<?rfc include="reference.RFC.8341.xml"?>
<?rfc include="reference.RFC.8446.xml"?>
<?rfc include="reference.RFC.9000.xml"?>
<reference anchor="Std-1003.1-2008" target="http://pubs.opengroup.org/onlinepubs
/9699919799/">
<front>
<title>"Chapter 9: Regular Expressions". The Open Group Base
Specifications Issue 6, IEEE Std 1003.1-2008, 2016 Edition.</title>
<author fullname="IEEE and The Open Group">
<organization>The Open Group</organization>
</author>
<date month="September" year="2016"/>
</front>
</reference>
</references>
<references title="Informative References"> </section>
<section>
<name>The YANG Module Names Registry</name>
<t>This document registers one YANG module in the "YANG Module Names"
registry <xref target="RFC8525"/>, following the format in <xref target="
RFC7950"/>:</t>
<dl spacing="compact" newline="false">
<dt>Name:</dt><dd>ietf-syslog</dd>
<dt>Namespace:</dt><dd>urn:ietf:params:xml:ns:yang:ietf-syslog</dd>
<dt>Prefix:</dt><dd>syslog</dd>
<dt>Reference:</dt><dd>RFC 9742</dd>
</dl>
<?rfc include="reference.RFC.8340.xml"?> </section>
<?rfc include="reference.RFC.8342.xml"?> </section>
<section>
<name>Security Considerations</name>
<t>
This section is modeled after the template defined in <xref target="I-D.ietf-ne
tmod-rfc8407bis"/>.
</t>
<t>
<!-- DNE -->
The "ietf-syslog" YANG module defines a data model that is designed to be
accessed via YANG-based management protocols, such as NETCONF <xref
target="RFC6241"/> and RESTCONF <xref target="RFC8040"/>. These protocols
have to use a secure transport layer (e.g., SSH <xref target="RFC4252"/>,
TLS <xref target="RFC8446"/>, and QUIC <xref target="RFC9000"/>) and have
to use mutual authentication.
<!-- End of DNE -->
</t>
<t>
<!-- DNE -->
The Network Configuration Access Control Model (NACM) <xref
target="RFC8341"/> provides the means to restrict access for particular
NETCONF or RESTCONF users to a preconfigured subset of all available
NETCONF or RESTCONF protocol operations and content.
</t>
<!-- End of DNE -->
<t>
This module imports groupings from ietf-crypto-types YANG module
defined in <xref target="RFC9640">YANG
Groupings for Crypto Types</xref>. Security considerations
described in that document apply to this module also.
</t>
<t>
<!-- DNE -->
There are a number of data nodes defined in this YANG module that are
writable/creatable/deletable (i.e., "config true", which is the default).
All writable data nodes are likely to be reasonably sensitive or vulnerable
in some network environments. Write operations (e.g., edit-config) and
delete operations to these data nodes without proper protection or
authentication can have a negative effect on network operations. The
following subtrees and data nodes have particular
sensitivities/vulnerabilities:
<!-- End of DNE -->
</t>
<dl newline="false" spacing="normal">
<dt> facility-filter/pattern-match:</dt>
<dd>When writing
this node, implementations <bcp14>MUST</bcp14> ensure that the regular
expression pattern match is not constructed to cause a regular
expression denial-of-service attack due to a pattern that
causes the regular expression implementation to work very
slowly (exponentially related to input size).
</dd>
<dt> remote/destination/signing/cert-signer:</dt>
<dd>When writing this subtree, implementations <bcp14>MUST NOT</bcp14>
specify a private key that is used for any other purpose.</dd>
</dl>
<t>
<!-- DNE -->
Some of the readable data nodes in this YANG module may be considered
sensitive or vulnerable in some network environments. It is thus important
to control read access (e.g., via get, get-config, or notification) to
these data nodes. Specifically, the following subtrees and data nodes have
particular sensitivities/ vulnerabilities:
<!-- End of DNE -->
</t>
<dl newline="false" spacing="normal">
<dt> remote/destination/transport:</dt>
<dd>This subtree
contains information about other hosts in the network, the
services available on those hosts, and the TLS transport
certificate properties if TLS is selected as the transport
protocol. Knowing that a service like syslog (udp/514) is
enabled on the host will allow a malicious user to spam the
host on that port.
</dd>
<dt> remote/destination/signing:</dt>
<dd>This subtree contains
information about the syslog message signing properties,
including signing certificate information.
</dd>
</dl>
<t>
There are no particularly sensitive RPC or action operations.
</t>
</section>
</middle>
<back>
<displayreference target="I-D.ietf-netmod-rfc8407bis" to="YANG-GUIDELINES"/>
<references>
<name>References</name>
<references>
<name>Normative References</name>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.96
40.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.96
45.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.83
43.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.21
19.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.36
88.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.54
24.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.54
25.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.54
26.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.58
48.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.69
91.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.85
25.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.79
50.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.80
89.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.81
74.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.83
41.xml"/>
</references> <reference anchor="Std-1003.1-2024" target="https://pubs.opengroup.org/on
linepubs/9799919799">
<front>
<title>"Chapter 9: Regular Expressions" The Open Group Base
Specifications Issue 8, IEEE Std 1003.1-2024</title>
<author>
<organization>The Open Group</organization>
</author>
<date year="2024"/>
</front>
</reference>
<reference anchor="W3C.REC-xml-20081126" target="https://www.w3.org/TR/2
008/REC-xml-20081126/">
<front>
<title>Extensible Markup Language (XML) 1.0 (Fifth Edition)</title>
<author initials="T." surname="Bray" fullname="Tim Bray"/>
<author initials="J." surname="Paoli" fullname="Jean Paoli"/>
<author initials="C.M." surname="Sperberg-McQueen" fullname="C. M. S
perberg-McQueen"/>
<author initials="E." surname="Maler" fullname="Eve Maler"/>
<author initials="F." surname="Yergeau" fullname="François Yergeau"/
>
<date month="November" year="2008"/>
</front>
<seriesInfo name="World Wide Web Consortium Recommendation" value="REC
-xml-20081126"/>
</reference>
</references>
<references>
<name>Informative References</name>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml3/reference.I-D.i
etf-netmod-rfc8407bis.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.62
41.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8
340.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8
342.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.90
00.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.42
52.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.80
40.xml"/>
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.84
46.xml"/>
</references>
</references>
<section anchor="tree-diagrams">
<name>Tree Diagrams</name>
<section anchor="complete-tree-diagram">
<name>Complete Tree Diagram</name>
<section anchor="tree-diagrams" title="Tree Diagrams"> <sourcecode type="yangtree"><![CDATA[
<section anchor="complete-tree-diagram" title="Complete Tree Diagram">
<figure>
<artwork align="left"><![CDATA[
[note: '\' line wrapping for formatting only] [note: '\' line wrapping for formatting only]
module: ietf-syslog module: ietf-syslog
+--rw syslog! +--rw syslog!
+--rw actions +--rw actions
+--rw console! {console-action}? +--rw console! {console-action}?
| +--rw filter | +--rw filter
| | +--rw facility-list* [facility severity] | | +--rw facility-list* [facility severity]
| | +--rw facility union | | +--rw facility union
| | +--rw severity union | | +--rw severity union
skipping to change at line 1797 skipping to change at line 1584
| +--rw port? | +--rw port?
| | inet:port-number | | inet:port-number
| +--rw client-identity! | +--rw client-identity!
| | +--rw (auth-type) | | +--rw (auth-type)
| | +--:(certificate) | | +--:(certificate)
| | | {client-ident-x509-cert}? | | | {client-ident-x509-cert}?
| | | +--rw certificate | | | +--rw certificate
| | | +--rw (inline-or-keystore) | | | +--rw (inline-or-keystore)
| | | +--:(inline) | | | +--:(inline)
| | | | {inline-definition\ | | | | {inline-definition\
s-s s-supported}?
upported}?
| | | | +--rw inline-definition | | | | +--rw inline-definition
| | | | +--rw public-key-form\ | | | | +--rw public-key-form\
at? at?
| | | | | identityref | | | | | identityref
| | | | +--rw public-key? | | | | +--rw public-key?
| | | | | binary | | | | | binary
| | | | +--rw private-key-for\ | | | | +--rw private-key-for\
mat mat?
?
| | | | | identityref | | | | | identityref
| | | | +--rw (private-key-ty\ | | | | +--rw (private-key-ty\
pe) pe)
| | | | | +--:(cleartext-pri\ | | | | | +--:(cleartext-pri\
vat vate-key)
e-key)
| | | | | | {cleartex\ | | | | | | {cleartex\
t-p t-private-keys}?
rivate-keys}?
| | | | | | +--rw cleartext\ | | | | | | +--rw cleartext\
-pr -private-key?
ivate-key?
| | | | | | binary | | | | | | binary
| | | | | +--:(hidden-privat\ | | | | | +--:(hidden-privat\
e-k e-key)
ey)
| | | | | | {hidden-p\ | | | | | | {hidden-p\
riv rivate-keys}?
ate-keys}?
| | | | | | +--rw hidden-pr\ | | | | | | +--rw hidden-pr\
iva ivate-key?
te-key?
| | | | | | empty | | | | | | empty
| | | | | +--:(encrypted-pri\ | | | | | +--:(encrypted-pri\
vat vate-key)
e-key)
| | | | | {encrypte\ | | | | | {encrypte\
d-p d-private-keys}?
rivate-keys}?
| | | | | +--rw encrypted\ | | | | | +--rw encrypted\
-pr -private-key
ivate-key
| | | | | +--rw encryp\ | | | | | +--rw encryp\
ted ted-by
-by
| | | | | +--rw encryp\ | | | | | +--rw encryp\
ted ted-value-format
-value-format
| | | | | | iden\ | | | | | | iden\
tit tityref
yref
| | | | | +--rw encryp\ | | | | | +--rw encryp\
ted ted-value
-value
| | | | | bina\ | | | | | bina\
ry ry
| | | | +--rw cert-data? | | | | +--rw cert-data?
| | | | | end-entity-ce\ | | | | | end-entity-ce\
rt- rt-cms
cms
| | | | +---n certificate-exp\ | | | | +---n certificate-exp\
ira iration
tion
| | | | | {certificate-\ | | | | | {certificate-\
exp expiration-notification}?
iration-notification}?
| | | | | +-- expiration-dat\ | | | | | +-- expiration-dat\
e e
| | | | | yang:date-\ | | | | | yang:date-\
and and-time
-time
| | | | +---x generate-csr | | | | +---x generate-csr
| | | | {csr-generati\ | | | | {csr-generati\
on} on}?
?
| | | | +---w input | | | | +---w input
| | | | | +---w csr-forma\ | | | | | +---w csr-forma\
t t
| | | | | | identit\ | | | | | | identit\
yre yref
f
| | | | | +---w csr-info | | | | | +---w csr-info
| | | | | csr-inf\ | | | | | csr-inf\
o o
| | | | +--ro output | | | | +--ro output
| | | | +--ro (csr-type\ | | | | +--ro (csr-type\
) )
| | | | +--:(p10-csr\ | | | | +--:(p10-csr\
) )
| | | | +--ro p10\ | | | | +--ro p10\
-cs -csr?
r?
| | | | p\ | | | | p\
10- 10-csr
csr
| | | +--:(central-keystore) | | | +--:(central-keystore)
| | | {central-keystore-\ | | | {central-keystore-\
sup supported,asymmetric-keys}?
ported,asymmetric-keys}?
| | | +--rw central-keystore-r\ | | | +--rw central-keystore-r\
efe eference
rence
| | | +--rw asymmetric-key?\ | | | +--rw asymmetric-key?\
| | | | ks:central-as\ | | | | ks:central-as\
ymm ymmetric-key-ref
etric-key-ref
| | | | {central-keys\ | | | | {central-keys\
tor tore-supported,asymmetric-keys}?
e-supported,asymmetric-keys}?
| | | +--rw certificate? | | | +--rw certificate?
| | | leafref | | | leafref
| | +--:(raw-public-key) | | +--:(raw-public-key)
| | | {client-ident-raw-public-ke\ | | | {client-ident-raw-public-ke\
y}? y}?
| | | +--rw raw-private-key | | | +--rw raw-private-key
| | | +--rw (inline-or-keystore) | | | +--rw (inline-or-keystore)
| | | +--:(inline) | | | +--:(inline)
| | | | {inline-definition\ | | | | {inline-definition\
s-s s-supported}?
upported}?
| | | | +--rw inline-definition | | | | +--rw inline-definition
| | | | +--rw public-key-form\ | | | | +--rw public-key-form\
at? at?
| | | | | identityref | | | | | identityref
| | | | +--rw public-key? | | | | +--rw public-key?
| | | | | binary | | | | | binary
| | | | +--rw private-key-for\ | | | | +--rw private-key-for\
mat mat?
?
| | | | | identityref | | | | | identityref
| | | | +--rw (private-key-ty\ | | | | +--rw (private-key-ty\
pe) pe)
| | | | +--:(cleartext-pri\ | | | | +--:(cleartext-pri\
vat vate-key)
e-key)
| | | | | {cleartex\ | | | | | {cleartex\
t-p t-private-keys}?
rivate-keys}?
| | | | | +--rw cleartext\ | | | | | +--rw cleartext\
-pr -private-key?
ivate-key?
| | | | | binary | | | | | binary
| | | | +--:(hidden-privat\ | | | | +--:(hidden-privat\
e-k e-key)
ey)
| | | | | {hidden-p\ | | | | | {hidden-p\
riv rivate-keys}?
ate-keys}?
| | | | | +--rw hidden-pr\ | | | | | +--rw hidden-pr\
iva ivate-key?
te-key?
| | | | | empty | | | | | empty
| | | | +--:(encrypted-pri\ | | | | +--:(encrypted-pri\
vat vate-key)
e-key)
| | | | {encrypte\ | | | | {encrypte\
d-p d-private-keys}?
rivate-keys}?
| | | | +--rw encrypted\ | | | | +--rw encrypted\
-pr -private-key
ivate-key
| | | | +--rw encryp\ | | | | +--rw encryp\
ted ted-by
-by
| | | | +--rw encryp\ | | | | +--rw encryp\
ted ted-value-format
-value-format
| | | | | iden\ | | | | | iden\
tit tityref
yref
| | | | +--rw encryp\ | | | | +--rw encryp\
ted ted-value
-value
| | | | bina\ | | | | bina\
ry ry
| | | +--:(central-keystore) | | | +--:(central-keystore)
| | | {central-keystore-\ | | | {central-keystore-\
sup supported,asymmetric-keys}?
ported,asymmetric-keys}?
| | | +--rw central-keystore-r\ | | | +--rw central-keystore-r\
efe eference?
rence?
| | | ks:central-asymm\ | | | ks:central-asymm\
etr etric-key-ref
ic-key-ref
| | +--:(tls12-psk) | | +--:(tls12-psk)
| | | {client-ident-tls12-psk}? | | | {client-ident-tls12-psk}?
| | | +--rw tls12-psk | | | +--rw tls12-psk
| | | +--rw (inline-or-keystore) | | | +--rw (inline-or-keystore)
| | | | +--:(inline) | | | | +--:(inline)
| | | | | {inline-definition\ | | | | | {inline-definition\
s-s s-supported}?
upported}?
| | | | | +--rw inline-definition | | | | | +--rw inline-definition
| | | | | +--rw key-format? | | | | | +--rw key-format?
| | | | | | identityref | | | | | | identityref
| | | | | +--rw (key-type) | | | | | +--rw (key-type)
| | | | | +--:(cleartext-sym\ | | | | | +--:(cleartext-sym\
met metric-key)
ric-key)
| | | | | | +--rw cleartext\ | | | | | | +--rw cleartext\
-sy -symmetric-key?
mmetric-key?
| | | | | | binary | | | | | | binary
| | | | | | {cleart\ | | | | | | {cleart\
ext ext-symmetric-keys}?
-symmetric-keys}?
| | | | | +--:(hidden-symmet\ | | | | | +--:(hidden-symmet\
ric ric-key)
-key)
| | | | | | {hidden-s\ | | | | | | {hidden-s\
ymm ymmetric-keys}?
etric-keys}?
| | | | | | +--rw hidden-sy\ | | | | | | +--rw hidden-sy\
mme mmetric-key?
tric-key?
| | | | | | empty | | | | | | empty
| | | | | +--:(encrypted-sym\ | | | | | +--:(encrypted-sym\
met metric-key)
ric-key)
| | | | | {encrypte\ | | | | | {encrypte\
d-s d-symmetric-keys}?
ymmetric-keys}?
| | | | | +--rw encrypted\ | | | | | +--rw encrypted\
-sy -symmetric-key
mmetric-key
| | | | | +--rw encryp\ | | | | | +--rw encryp\
ted ted-by
-by
| | | | | +--rw encryp\ | | | | | +--rw encryp\
ted ted-value-format
-value-format
| | | | | | iden\ | | | | | | iden\
tit tityref
yref
| | | | | +--rw encryp\ | | | | | +--rw encryp\
ted ted-value
-value
| | | | | bina\ | | | | | bina\
ry ry
| | | | +--:(central-keystore) | | | | +--:(central-keystore)
| | | | {central-keystore-\ | | | | {central-keystore-\
sup supported,symmetric-keys}?
ported,symmetric-keys}?
| | | | +--rw central-keystore-r\ | | | | +--rw central-keystore-r\
efe eference?
rence?
| | | | ks:central-symme\ | | | | ks:central-symme\
tri tric-key-ref
c-key-ref
| | | +--rw id? | | | +--rw id?
| | | string | | | string
| | +--:(tls13-epsk) | | +--:(tls13-epsk)
| | {client-ident-tls13-epsk}? | | {client-ident-tls13-epsk}?
| | +--rw tls13-epsk | | +--rw tls13-epsk
| | +--rw (inline-or-keystore) | | +--rw (inline-or-keystore)
| | | +--:(inline) | | | +--:(inline)
| | | | {inline-definition\ | | | | {inline-definition\
s-s s-supported}?
upported}?
| | | | +--rw inline-definition | | | | +--rw inline-definition
| | | | +--rw key-format? | | | | +--rw key-format?
| | | | | identityref | | | | | identityref
| | | | +--rw (key-type) | | | | +--rw (key-type)
| | | | +--:(cleartext-sym\ | | | | +--:(cleartext-sym\
met metric-key)
ric-key)
| | | | | +--rw cleartext\ | | | | | +--rw cleartext\
-sy -symmetric-key?
mmetric-key?
| | | | | binary | | | | | binary
| | | | | {cleart\ | | | | | {cleart\
ext ext-symmetric-keys}?
-symmetric-keys}?
| | | | +--:(hidden-symmet\ | | | | +--:(hidden-symmet\
ric ric-key)
-key)
| | | | | {hidden-s\ | | | | | {hidden-s\
ymm ymmetric-keys}?
etric-keys}?
| | | | | +--rw hidden-sy\ | | | | | +--rw hidden-sy\
mme mmetric-key?
tric-key?
| | | | | empty | | | | | empty
| | | | +--:(encrypted-sym\ | | | | +--:(encrypted-sym\
met metric-key)
ric-key)
| | | | {encrypte\ | | | | {encrypte\
d-s d-symmetric-keys}?
ymmetric-keys}?
| | | | +--rw encrypted\ | | | | +--rw encrypted\
-sy -symmetric-key
mmetric-key
| | | | +--rw encryp\ | | | | +--rw encryp\
ted ted-by
-by
| | | | +--rw encryp\ | | | | +--rw encryp\
ted ted-value-format
-value-format
| | | | | iden\ | | | | | iden\
tit tityref
yref
| | | | +--rw encryp\ | | | | +--rw encryp\
ted ted-value
-value
| | | | bina\ | | | | bina\
ry ry
| | | +--:(central-keystore) | | | +--:(central-keystore)
| | | {central-keystore-\ | | | {central-keystore-\
sup supported,symmetric-keys}?
ported,symmetric-keys}?
| | | +--rw central-keystore-r\ | | | +--rw central-keystore-r\
efe eference?
rence?
| | | ks:central-symme\ | | | ks:central-symme\
tri tric-key-ref
c-key-ref
| | +--rw external-identity | | +--rw external-identity
| | | string | | | string
| | +--rw hash? | | +--rw hash?
| | | tlscmn:epsk-supported-\ | | | tlscmn:epsk-supported-\
has hash
h
| | +--rw context? | | +--rw context?
| | | string | | | string
| | +--rw target-protocol? | | +--rw target-protocol?
| | | uint16 | | | uint16
| | +--rw target-kdf? | | +--rw target-kdf?
| | uint16 | | uint16
| +--rw server-authentication | +--rw server-authentication
| | +--rw ca-certs! {server-auth-x509-cert}\ | | +--rw ca-certs! {server-auth-x509-cert}\
? ?
| | | +--rw (inline-or-truststore) | | | +--rw (inline-or-truststore)
| | | +--:(inline) | | | +--:(inline)
| | | | {inline-definitions-supp\ | | | | {inline-definitions-supp\
ort orted}?
ed}?
| | | | +--rw inline-definition | | | | +--rw inline-definition
| | | | +--rw certificate* [name] | | | | +--rw certificate* [name]
| | | | +--rw name | | | | +--rw name
| | | | | string | | | | | string
| | | | +--rw cert-data | | | | +--rw cert-data
| | | | | trust-anchor-cer\ | | | | | trust-anchor-cer\
t-c t-cms
ms
| | | | +---n certificate-expira\ | | | | +---n certificate-expira\
tio tion
n
| | | | {certificate-exp\ | | | | {certificate-exp\
ira iration-notification}?
tion-notification}?
| | | | +-- expiration-date | | | | +-- expiration-date
| | | | yang:date-and\ | | | | yang:date-and\
-ti -time
me
| | | +--:(central-truststore) | | | +--:(central-truststore)
| | | {central-truststore-supp\ | | | {central-truststore-supp\
ort orted,certificates}?
ed,certificates}?
| | | +--rw central-truststore-refer\ | | | +--rw central-truststore-refer\
enc ence?
e?
| | | ts:central-certificate\ | | | ts:central-certificate\
-ba -bag-ref
g-ref
| | +--rw ee-certs! {server-auth-x509-cert}\ | | +--rw ee-certs! {server-auth-x509-cert}\
? ?
| | | +--rw (inline-or-truststore) | | | +--rw (inline-or-truststore)
| | | +--:(inline) | | | +--:(inline)
| | | | {inline-definitions-supp\ | | | | {inline-definitions-supp\
ort orted}?
ed}?
| | | | +--rw inline-definition | | | | +--rw inline-definition
| | | | +--rw certificate* [name] | | | | +--rw certificate* [name]
| | | | +--rw name | | | | +--rw name
| | | | | string | | | | | string
| | | | +--rw cert-data | | | | +--rw cert-data
| | | | | trust-anchor-cer\ | | | | | trust-anchor-cer\
t-c t-cms
ms
| | | | +---n certificate-expira\ | | | | +---n certificate-expira\
tio tion
n
| | | | {certificate-exp\ | | | | {certificate-exp\
ira iration-notification}?
tion-notification}?
| | | | +-- expiration-date | | | | +-- expiration-date
| | | | yang:date-and\ | | | | yang:date-and\
-ti -time
me
| | | +--:(central-truststore) | | | +--:(central-truststore)
| | | {central-truststore-supp\ | | | {central-truststore-supp\
ort orted,certificates}?
ed,certificates}?
| | | +--rw central-truststore-refer\ | | | +--rw central-truststore-refer\
enc ence?
e?
| | | ts:central-certificate\ | | | ts:central-certificate\
-ba -bag-ref
g-ref
| | +--rw raw-public-keys! | | +--rw raw-public-keys!
| | | {server-auth-raw-public-key}? | | | {server-auth-raw-public-key}?
| | | +--rw (inline-or-truststore) | | | +--rw (inline-or-truststore)
| | | +--:(inline) | | | +--:(inline)
| | | | {inline-definitions-supp\ | | | | {inline-definitions-supp\
ort orted}?
ed}?
| | | | +--rw inline-definition | | | | +--rw inline-definition
| | | | +--rw public-key* [name] | | | | +--rw public-key* [name]
| | | | +--rw name | | | | +--rw name
| | | | | string | | | | | string
| | | | +--rw public-key-format | | | | +--rw public-key-format
| | | | | identityref | | | | | identityref
| | | | +--rw public-key | | | | +--rw public-key
| | | | binary | | | | binary
| | | +--:(central-truststore) | | | +--:(central-truststore)
| | | {central-truststore-supp\ | | | {central-truststore-supp\
ort orted,public-keys}?
ed,public-keys}?
| | | +--rw central-truststore-refer\ | | | +--rw central-truststore-refer\
enc ence?
e?
| | | ts:central-public-key-\ | | | ts:central-public-key-\
bag bag-ref
-ref
| | +--rw tls12-psks? empty | | +--rw tls12-psks? empty
| | | {server-auth-tls12-psk}? | | | {server-auth-tls12-psk}?
| | +--rw tls13-epsks? empty | | +--rw tls13-epsks? empty
| | {server-auth-tls13-epsk}? | | {server-auth-tls13-epsk}?
| +--rw hello-params {tlscmn:hello-params}? | +--rw hello-params {tlscmn:hello-params}?
| | +--rw tls-versions | | +--rw tls-versions
| | | +--rw min? identityref | | | +--rw min? identityref
| | | +--rw max? identityref | | | +--rw max? identityref
| | +--rw cipher-suites | | +--rw cipher-suites
| | +--rw cipher-suite* | | +--rw cipher-suite*
| | tlscsa:tls-cipher-suite-algo\ | | tlscsa:tls-cipher-suite-algo\
rit rithm
hm
| +--rw keepalives {tls-client-keepalives}? | +--rw keepalives {tls-client-keepalives}?
| +--rw peer-allowed-to-send? empty | +--rw peer-allowed-to-send? empty
| +--rw test-peer-aliveness! | +--rw test-peer-aliveness!
| +--rw max-wait? uint16 | +--rw max-wait? uint16
| +--rw max-attempts? uint8 | +--rw max-attempts? uint8
+--rw filter +--rw filter
| +--rw facility-list* [facility severity] | +--rw facility-list* [facility severity]
| +--rw facility union | +--rw facility union
| +--rw severity union | +--rw severity union
| +--rw advanced-compare {select-adv-compare}? | +--rw advanced-compare {select-adv-compare}?
skipping to change at line 2286 skipping to change at line 1972
| | | +--rw encrypted-private-key | | | +--rw encrypted-private-key
| | | +--rw encrypted-by | | | +--rw encrypted-by
| | | +--rw encrypted-value-format | | | +--rw encrypted-value-format
| | | | identityref | | | | identityref
| | | +--rw encrypted-value | | | +--rw encrypted-value
| | | binary | | | binary
| | +--rw cert-data? | | +--rw cert-data?
| | | end-entity-cert-cms | | | end-entity-cert-cms
| | +---n certificate-expiration | | +---n certificate-expiration
| | | {certificate-expiration-notificati\ | | | {certificate-expiration-notificati\
on} on}?
?
| | | +-- expiration-date | | | +-- expiration-date
| | | yang:date-and-time | | | yang:date-and-time
| | +---x generate-csr {csr-generation}? | | +---x generate-csr {csr-generation}?
| | +---w input | | +---w input
| | | +---w csr-format identityref | | | +---w csr-format identityref
| | | +---w csr-info csr-info | | | +---w csr-info csr-info
| | +--ro output | | +--ro output
| | +--ro (csr-type) | | +--ro (csr-type)
| | +--:(p10-csr) | | +--:(p10-csr)
| | +--ro p10-csr? p10-csr | | +--ro p10-csr? p10-csr
| +--rw hash-algorithm? enumeration | +--rw hash-algorithm? enumeration
+--rw cert-initial-repeat? uint32 +--rw cert-initial-repeat? uint32
+--rw cert-resend-delay? uint32 +--rw cert-resend-delay? uint32
+--rw cert-resend-count? uint32 +--rw cert-resend-count? uint32
+--rw sig-max-delay? uint32 +--rw sig-max-delay? uint32
+--rw sig-number-resends? uint32 +--rw sig-number-resends? uint32
+--rw sig-resend-delay? uint32 +--rw sig-resend-delay? uint32
+--rw sig-resend-count? uint32 +--rw sig-resend-count? uint32
]]></artwork> ]]></sourcecode>
</figure> </section>
</section> </section>
</section> <section>
<name>Implementer Guidelines</name>
<section title="Implementer Guidelines"> <section anchor="extending_facilities">
<section anchor="extending_facilities" title="Extending Facilities"> <name>Extending Facilities</name>
<t>Many vendors extend the list of facilities available for logging in <t>Many vendors extend the list of facilities available for logging in
their implementation. Additional facilities may not work with the their implementation. Additional facilities may not work with the
syslog protocol as defined in [RFC5424] and hence such facilities syslog protocol as defined in <xref target="RFC5424"/>. Thus, such facil ities
apply for local syslog-like logging functionality.</t> apply for local syslog-like logging functionality.</t>
<t>The following is an example that shows how additional facilities
could be added to the list of available facilities (two facilities are a
dded in this example):</t>
<t>The following is an example that shows how additional facilities <sourcecode type="yang" name="example-vendor-syslog-types@2025-03-03.yan
could be added to the list of available facilities (in this example g"><![CDATA[
two facilities are added):</t>
<figure>
<artwork align="left"><![CDATA[
[note: '\' line wrapping for formatting only]
module example-vendor-syslog-types { module example-vendor-syslog-types {
namespace "http://example.com/ns/vendor-syslog-types"; namespace "http://example.com/ns/vendor-syslog-types";
prefix vendor-syslogtypes; prefix vendor-syslogtypes;
import ietf-syslog { import ietf-syslog {
prefix syslog; prefix syslog;
} }
organization organization
"Example, Inc."; "Example, Inc.";
contact contact
"Example, Inc. "Example, Inc.
Customer Service Customer Service
E-mail: syslog-yang@example.com"; Email: syslog-yang@example.com";
description description
"This module contains a collection of vendor-specific YANG type "This module contains a collection of vendor-specific YANG type
definitions for SYSLOG."; definitions for Syslog.";
revision 2024-03-19 { revision 2025-03-03 {
description description
"Version 1.0"; "Version 1.0";
reference reference
"Vendor SYSLOG Types: SYSLOG YANG Model"; "Vendor Syslog Types: Syslog YANG Module";
} }
identity vendor_specific_type_1 { identity vendor_specific_type_1 {
base syslog:syslog-facility; base syslog:syslog-facility;
description description
"Adding vendor specific type 1 to syslog-facility"; "Adding vendor-specific type 1 to syslog-facility";
} }
identity vendor_specific_type_2 { identity vendor_specific_type_2 {
base syslog:syslog-facility; base syslog:syslog-facility;
description description
"Adding vendor specific type 2 to syslog-facility"; "Adding vendor-specific type 2 to syslog-facility";
} }
} }]]></sourcecode>
]]></artwork> </section>
</figure> <section>
</section> <name>Syslog Terminal Output</name>
<section title="Syslog Terminal Output"> <t>Terminal output with requirements more complex than the console
<t>Terminal output with requirements more complex than the console subtree currently provides are expected to be supported via vendor
subtree currently provides, are expected to be supported via vendor
extensions rather than handled via the file subtree.</t> extensions rather than handled via the file subtree.</t>
</section> </section>
<section title="Syslog File Naming Convention"> <section>
<t>The syslog/file/log-file/file-rotation container contains <name>Syslog File Naming Convention</name>
<t>The syslog/file/log-file/file-rotation container contains
configuration parameters for syslog file rotation. This section configuration parameters for syslog file rotation. This section
describes how these fields might be used by an implementer to name describes how these fields might be used by an implementer to name
syslog files in a rotation process. This information is offered as syslog files in a rotation process. This information is offered as
an informative guide only.</t> an informative guide only.</t>
<t>When an active syslog file with a name specified by log-file/name
<t>When an active syslog file with a name specified by log-file/name,
reaches log-file/max-file-size and/or syslog events arrive after the reaches log-file/max-file-size and/or syslog events arrive after the
period specified by log-file/rollover, the logging system can close period specified by log-file/rollover, the logging system can close
the file, can compress it, and can name the archive file &lt;log-file/ the file, compress it, and name the archive file &lt;log-file/
name>.0.gz. The logging system can then open a new active syslog name&gt;.0.gz. The logging system can then open a new active syslog
file &lt;log-file/name>.</t> file &lt;log-file/name&gt;.</t>
<t>When the new syslog file reaches either of the size limits referenced
<t>When the new syslog file reaches either of the size limits referenced above, &lt;log-file/name&gt;.0.gz can be renamed &lt;log-file/name&gt;.1.gz an
above, &lt;log-file/name>.0.gz can be renamed &lt;log-file/name>.1.gz and d
the new syslog file can be closed, compressed and renamed &lt;log-file/ the new syslog file can be closed, compressed, and renamed &lt;log-file/
name>.0.gz. Each time that a new syslog file is closed, each of the name&gt;.0.gz. Each time that a new syslog file is closed, each of the
prior syslog archive files named &lt;log-file/name>.&lt;n>.gz can be prior syslog archive files named &lt;log-file/name&gt;.&lt;n&gt;.gz can be
renamed to &lt;log-file/name>.&lt;n + 1>.gz.</t> renamed to &lt;log-file/name&gt;.&lt;n + 1&gt;.gz.</t>
<t>Removal of archive log files could occur when either or both:</t>
<t>- log-file/number-of-files specified - the logging system can create
up to log-file/number-of-files syslog archive files after which, the
contents of the oldest archived file could be overwritten.</t>
<t>- log-file/retention specified - the logging system can remove those
syslog archive files whose file expiration time (file creation time
plus the specified log-file/retention time) is prior to the current
time.</t>
</section>
</section>
<!-- Change Log
v07 2016-03-20 CW Converted the document to XML format and incorporated
changes from Martin Bjorklund and Tom Petch.
v08 2016-05-07 CW Incorporated changes from Benoit Claise, Tom Petch,
and Mahesh Jethanandani.
v09 2016-07-08 CW Incorporated changes from Jason Sterne, Tom Petch,
and Juergen Schoenwaelder.
v10 2016-10-30 CW Incorporated changes from Juergen Schoenwaelder.
v11 2016-11-13 CW Incorporated changes from Phil Shafer.
v12 2017-02-14 CW Incorporated changes from Andy Bierman and Alex Campbell.
v13 2017-03-13 CW Incorporated changes from various contributors.
v14 2017-03-27 CW Incorporated changes from various contributors.
v15 2017-06-07 CW Incorporated changes from various contributors.
v16 2017-08-11 CW Incorporated changes from various contributors.
v17 2017-09-08 CW Incorporated changes from various contributors.
v18 2017-12-08 CW Incorporated changes from various contributors.
v19 2018-01-12 CW Incorporated changes from various contributors.
v20 2018-02-09 CW Incorporated changes from various contributors.
v21 2018-02-14 CW Incorporated changes from various contributors. <t>Removal of archive log files could occur when either or both:</t>
<ul>
<li>log-file/number-of-files is specified. The logging system can create
up to log-file/number-of-files syslog archive files, after which the
contents of the oldest archived file could be overwritten.</li>
v22 2018-02-21 CW Incorporated changes from Yaron Sheffer and Ron Bonica. <li>log-file/retention is specified. The logging system can remove those
syslog archive files whose file expiration time (file creation time
plus the specified log-file/retention time) is prior to the current
time.</li>
</ul>
</section>
</section>
<section numbered="false" anchor="Acknowledgements">
<name>Acknowledgements</name>
<t>The authors wish to thank the following who commented on this
proposal:</t>
<t><contact fullname="Andy Bierman"/>, <contact fullname="Martin
Bjorklund"/>, <contact fullname="Alex Campbell"/>, <contact
fullname="Alex Clemm"/>, <contact fullname="Francis Dupont"/>, <contact
fullname="Jim Gibson"/>, <contact fullname="Jeffrey Haas"/>, <contact
fullname="Bob Harold"/>, <contact fullname="John Heasley"/>, <contact
fullname="Giles Heron"/>, <contact fullname="Lisa Huang"/>, <contact
fullname="Mahesh Jethanandani"/>, <contact fullname="Warren Kumari"/>,
<contact fullname="Jeffrey K Lange"/>, <contact fullname="Jan
Lindblad"/>, <contact fullname="Chris Lonvick"/>, <contact
fullname="Alexey Melnikov"/>, <contact fullname="Kathleen Moriarty"/>,
<contact fullname="Tom Petch"/>, <contact fullname="Adam Roach"/>,
<contact fullname="Juergen Schoenwaelder"/>, <contact fullname="Phil
Shafer"/>, <contact fullname="Yaron Sheffer"/>, <contact fullname="Jason
Sterne"/>, <contact fullname="Peter Van Horne"/>, <contact
fullname="Kent Watsen"/>, <contact fullname="Bert Wijnen"/>, <contact
fullname="Dale R Worley"/>, and <contact fullname="Aleksandr
Zhdankin"/>.</t>
</section>
v23 2018-03-01 CW Incorporated changes from Kent. -->
</back> </back>
</rfc> </rfc>
 End of changes. 204 change blocks. 
1950 lines changed or deleted 1661 lines changed or added

This html diff was produced by rfcdiff 1.48.