Proposal for Event Log Authors: Date:2006-03-05 March 2006 Month Year November 2005 March 2006 Proposal for Event Log Authors: Date:2006-03-05 Notice: This document has been prepared to assist IEEE 802.11. It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein. Release: The contributor grants a free, irrevocable license to the IEEE to incorporate material contained in this contribution, and any modifications thereof, in the creation of an IEEE Standards publication; to copyright in the IEEE’s name any IEEE Standards publication even though it may include portions of this contribution; and at the IEEE’s sole discretion to permit others to reproduce in whole or in part the resulting IEEE Standards publication. The contributor also acknowledges and accepts that this contribution may be made public by IEEE 802.11. Patent Policy and Procedures: The contributor is familiar with the IEEE 802 Patent Policy and Procedures <http:// ieee802.org/guides/bylaws/sb-bylaws.pdf>, including the statement "IEEE standards may include the known use of patent(s), including patent applications, provided the IEEE receives assurance from the patent holder or applicant with respect to patents essential for compliance with both mandatory and optional portions of the standard." Early disclosure to the Working Group of patent information that might be relevant to the standard is essential to reduce the possibility for delays in the development process and increase the likelihood that the draft publication will be approved for publication. Please notify the Chair <stuart.kerry@philips.com> as early as possible, in written or electronic form, if patented technology (or technology under patent application) might be incorporated into a draft standard being developed within the IEEE 802.11 Working Group. If you have questions, contact the IEEE Patent Committee Administrator at <patcom@ieee.org>. Emily Qi et al Emily Qi et al

Month Year November 2005 March 2006 Abstract This document contains an outline of normative text proposal for Event Log (06/0346r1), which is based on the Event Log part of 05/1070r3 and updated to address the comments that have been received since the Hawaii meeting. Emily Qi et al Emily Qi et al

Proposal Summary Propose four Event Log types Add Event Log Filtering Month Year November 2005 March 2006 Proposal Summary Propose four Event Log types Transition Event Log RSNA Event Log Peer-to-Peer Link Event Log Syslog Event Log Add Event Log Filtering Allow the requesting STA to specify a reporting filter condition for Event Log Reporting Add Event Log Alerting Allow a STA to report event log when experiencing problems or failures. Emily Qi et al Emily Qi et al

Transition Event Log Fields Purpose Possible applications include Month Year November 2005 March 2006 Transition Event Log Fields Source BSSID, Source RCPI, Source RSNI Target BSSID, Target RCPI, Target RSNI Transition Time Transition Reason Transition Result Purpose Provide the AP with a historical view of the previous transition events for a given client STA. Possible applications include Frequent handover troubleshooting Network coverage diagnostic and troubleshooting Mobile user mobility characteristics analysis, etc Emily Qi et al Emily Qi et al

RSNA Event Log Fields Purpose Possible applications include: Month Year November 2005 March 2006 RSNA Event Log Fields Target BSSID, RSN IE Authentication Type, EAP method RSNA Result Purpose Provide the AP with a historical view of the previous authentication events for a given client STA. Possible applications include: Detect possible DOS attacks, i.e. dictionary attack Diagnose of authentication and key establishment failures Emily Qi et al Emily Qi et al

Peer-to-Peer Link Event Log Month Year November 2005 March 2006 Peer-to-Peer Link Event Log Fields Peer STA address Channel number Regulatory Class STA Tx Power Connection time Purpose Provide the AP with a historical view of the previous peer to peer connectivity. Possible applications include: Radio configuration or management to avoid interference, etc. Direct Link management Emily Qi et al Emily Qi et al

Syslog Event Log Contents Purpose Possible Applications: Month Year November 2005 March 2006 Syslog Event Log Contents PRI, HEADER and MSG portion of a Syslog message [RFC3164]. The MSG portion of the message shall begin with the ASCII representation of the client MAC address Purpose Provide the AP with an extensible, a vendor specific event log or “human” readable log for a given client STA. Provide insight into the trouble being experienced by client. The messages may indicate failures for anything from 802.11 operation to system operation. Possible Applications: Vendor Specific Log and diagnostics Bootstrap debugging, etc. Emily Qi et al Emily Qi et al

Month Year November 2005 March 2006 Event Log Filtering Used to reduce the total number of Event Log Report elements returned for a given Event Log Report. Established at a STA by sending an Event Log Request frame containing one or more Event Log Request elements with the required filter sub-elements. If any of the filter sub-elements is present in the Event Log Request, the corresponding Event Log Report shall only include the events that meet the specified filtering condition and are logged within the current ESS Defined for each event log type, but Syslog. Emily Qi et al Emily Qi et al

Month Year November 2005 March 2006 Event Log Alerting Sent as an alert report to the requesting STA when a defined alerting condition is experienced – usually related to a problem or failure. Established at a STA by sending an Event Log Request frame containing one or more Event Log Request elements with the required alert sub-elements. An AP transition shall not cancel Event Log alerting if the transition is within the same ESS Defined for each event log type. Only one alerting defined, so far. Emily Qi et al Emily Qi et al

March 2006 Feedback? Emily Qi et al

Month Year November 2005 March 2006 Motion Move to include normative text in document 11-06-0346-01-000v-normative-text-proposal-event-log.doc into the TGv draft. Mover: Seconder: Results: Emily Qi et al Emily Qi et al