A YANG Data Model for Syslog Management
Extracted elements (26)
Terminal output with requirements more complex than the console subtree provides is expected to be handled via vendor extensions rather than through the file subtree, keeping the standard model simple and avoiding overloading file semantics for terminal use cases.
The model uses YANG 'feature' statements to allow implementations to advertise only the syslog capabilities they actually support (e.g., console-action, file-action, remote-action, structured-data, signed-messages). This was chosen to maximize flexibility across diverse vendor implementations that differ in which syslog features they provide.
Vendors can augment the ietf-syslog module to add proprietary features, and can extend the syslog-facility identity to add vendor-specific facility types. However, additional facilities beyond the RFC 5424 set may not work with the standard syslog protocol and apply only to local syslog-like logging.
The ietf-syslog module conforms to NMDA (RFC 8342) and imports typedefs from RFC 6991, groupings from RFC 9640 (crypto types) and RFC 9645 (TLS client/server groupings), and references RFC 5424 (syslog protocol), RFC 5425 (TLS transport), RFC 5426 (UDP transport), and RFC 5848 (signed syslog).
Implementations MUST ensure that the regular expression pattern-match value (facility-filter/pattern-match) is not constructed to cause a regular expression denial-of-service attack due to a pattern that causes exponential backtracking relative to input size.
Implementations MUST NOT specify a private key in remote/destination/signing/cert-signer that is used for any other purpose, to prevent key reuse across contexts.
Log file names MUST use the 'file:' URI scheme. The 'name' leaf type is inet:uri with a pattern constraint 'file:.*', referencing RFC 8089.
YANG-based management protocols accessing this module (NETCONF, RESTCONF) MUST use a secure transport layer (SSH, TLS, or QUIC) and MUST use mutual authentication.
File logging is configured via a 'log-file' list keyed by URI name (must use 'file:' scheme per RFC 8089). Each entry supports a 'file-rotation' container with number-of-files and max-file-size (size-based, gated by file-limit-size feature) and rollover and retention in minutes (time-based, gated by file-limit-duration feature).
Signed syslog message timing parameters include: cert-initial-repeat (default 3, number of Certificate Block sends before first message), cert-resend-delay (default 3600s), cert-resend-count (default 0), sig-max-delay (default 60s), sig-number-resends (default 0), sig-resend-delay (default 5s), and sig-resend-count (default 0).
The 'actions' container defines three collector types: console (requires console-action feature), file (requires file-action feature), and remote (requires remote-action feature). Each is independently feature-gated to allow implementations to support only what their platform provides.
The 'advanced-compare' container (gated by select-adv-compare feature) extends severity filtering with a 'compare' leaf (equals or equals-or-higher, default equals-or-higher) and an 'action' leaf (log, block, or stop). It is not applicable when severity is 'all' or 'none'.
The 'facility-override' leaf on remote destinations allows overriding the facility value in messages delivered to a remote server, using an identityref based on syslog-facility. The 'source-interface' leaf (gated by remote-source-interface feature) sets the outbound interface for remote syslog messages.
The ietf-syslog YANG module (namespace urn:ietf:params:xml:ns:yang:ietf-syslog) defines configuration for syslog collectors, organized under a top-level 'syslog' presence container with an 'actions' sub-container covering console, file, and remote destinations.
The remote 'destination' list supports a mandatory transport choice between UDP (RFC 5426, default port 514) and TLS (RFC 5425, default port 6514). Multiple destinations can be configured, but all sessions under a destination must use the same transport.
The 'selector' grouping defines syslog message filtering via a 'filter' container holding a 'facility-list' (keyed by facility and severity) and an optional 'pattern-match' leaf (POSIX 1003.2 regex against the MSG field, gated by the select-match feature). Both conditions must match when both are specified.
The 'severity-filter' grouping defines severity selection with special enumeration values 'none' (value 2147483647, matches nothing) and 'all' (value -2147483648, matches everything), plus standard syslog-severity enum values emergency(0) through debug(7). Lower numeric value means higher severity.
The 'signing' presence container (gated by signed-messages feature, referencing RFC 5848) configures signed syslog messages per destination. It contains a 'cert-signers' container for Signature Group 0 with cert-signer entries (name, asymmetric key pair with cert, hash algorithm SHA1 or SHA256) and timing parameters for certificate and signature block retransmission.
The 'structured-data' leaf (boolean, default false, gated by structured-data feature) controls whether log messages are written with RFC 5424 STRUCTURED-DATA elements or with STRUCTURED-DATA set to NILVALUE. Available on both file and remote destinations.
The syslog-facility identity hierarchy defines 24 standard facilities (kern=0 through local7=23) as YANG identities based on RFC 5424 Section 6.2.1. Vendors may extend this base identity to add proprietary facilities.
TLS transport configuration reuses the ietf-tls-client grouping from RFC 9645, supporting client identity (X.509 certificate, raw public key, TLS 1.2 PSK, TLS 1.3 EPSK), server authentication (CA certs, end-entity certs, raw public keys, PSKs), hello parameters (TLS version range, cipher suites), and keepalives.
This document registers one URI in the IETF XML Registry: 'urn:ietf:params:xml:ns:yang:ietf-syslog' as an XML namespace (no XML content, registrant is the IESG), per RFC 3688.
This document registers one YANG module in the YANG Module Names Registry (RFC 8525): name 'ietf-syslog', namespace 'urn:ietf:params:xml:ns:yang:ietf-syslog', prefix 'syslog', reference RFC 9742.
All writable data nodes are config true and sensitive; unauthorized write or delete operations (e.g., edit-config) without proper authentication can negatively affect network operations. NACM (RFC 8341) should be used to restrict access.
The remote/destination/signing subtree contains syslog message signing configuration including signing certificate information and is considered sensitive; read access should be controlled via NACM (RFC 8341).
The remote/destination/transport subtree exposes information about remote hosts and services (e.g., that UDP/514 syslog is enabled), which could allow a malicious user to spam those hosts. TLS transport configuration also reveals certificate properties.