Definitions of Managed Objects for Mapping SYSLOG Messages to Simple Network Management Protocol (SNMP) Notifications
draft-ietf-opsawg-syslog-msg-mib-06

I've cleared my Discuss that used to read:

> Nice work. Just a quick issue to discuss.
>
> When syslogMsgIndex wraps, the implementation knows where
> to write the next entry. But how does the reader know where
> to start in order to read the messages in the order they 
> arrived since the lowest value of syslogMsgIndex does not
> give this information.
 
The authors and WG have made a strong argument that complexity should be pushed to the management station and away from the agent. That means that it is not considered a burden for the management station to have to read and store the entire table in order to work out how to process the table. I would still prefer the table to include pointers to the oldest and newest entries to speed up accessing specific records, but the WG feel that this is not necessary for their implementations.

=== Original comments below ===

syslogMsgTableMaxSize 

Usefully says...

         If an application reduces the limit while there are syslog
         messages in the syslogMsgTable, the syslog messages that are
         in the syslogMsgTable for the longest time MUST be discarded
         to bring the table down to the new limit.

However, it is not clear how we know which entries have been in the
table for the longest time. I presume that the implementation is 
either required to maintain this information, or deduce it from the
index wrapping.

---

syslogMsgIndex 

It may be helpful to clarify whether...

  "A monotonically increasing number used to identify entries in
   the syslogMsgTable. When syslogMsgIndex reaches the maximum
   value the value wraps back to 1."

...means 4294967295 or the value of syslogMsgTableMaxSize.

---

Do you want to suggest that when objects in a table entry are read one
at a time, syslogMsgMsgID should be read first and last to check that
no change has been made to the row while the read was in progress?

I am agreeing with Adrian's DISCUSS.