Re: [Insipid] [dispatch] Proposed charter for work on logging

["Dawes, Peter, Vodafone Group" <[e-mail]>]

Hi Javier,
I am replying on the insipid mailing list as discussion has moved here from dispatch. 

The scenario you describe is what motivated the requirements draft and it would be very helpful to hear your views as discussion progresses.

Regards,
Peter

-----Original Message-----
From: Javier Martinez (mjavier) [mailto:[e-mail]] 
Sent: 26 June 2013 19:56
To: Dawes, Peter, Vodafone Group; Vijay K. Gurbani; [e-mail]
Subject: RE: [dispatch] Proposed charter for work on logging

Hi Peter,

I agree with the utility of the marker proposal. In large SIP network deployments it is a challenge collecting logs and debug traces during trouble  shooting  sessions, even with a single vendor deployments. In most situations you end up with large amounts of data to sort through to extract the sessions, or files  of interest from multiple boxes, in others you end up missing pieces of information.

There is a need for an automated way to extract the specific logs of interest in multi-vendor  deployments.
This  proposal is also a great complement to the "End-to-End Session Id" proposal.

I would be glad to help in any way to get an implementation proposal going,

Regards
Javier

-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of Dawes, Peter, Vodafone Group
Sent: Thursday, June 20, 2013 8:05 AM
To: Vijay K. Gurbani; [e-mail]
Subject: Re: [dispatch] Proposed charter for work on logging

Hi Vijay,
The utility of a marker is that currently there is no SIP protocol mechanism to indicate that signalling is of interest to logging, so it is not a logging format issue but an issue of making regression testing and troubleshooting scaleable by not having to log everything. 

Thanks for the pointer to RFC 6872, I will take a look at it.

Regards,
Peter

-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of Vijay K. Gurbani
Sent: 13 June 2013 22:23
To: [e-mail]
Subject: Re: [dispatch] Proposed charter for work on logging

On 06/13/2013 06:17 AM, Dawes, Peter, Vodafone Group wrote:
> Hello All, Following on from the comments at IETF#86 
> (http://www.ietf.org/proceedings/86/minutes/minutes-86-dispatch),
> where there was mild support for working on logging, I have updated 
> the log me requirements draft with 3 potential solutions (in clause
> 7) which can meet the requirements
> (http://www.ietf.org/internet-drafts/draft-dawes-dispatch-logme-reqs-02.txt).
> Opinions and comments on these or any other potential solutions would 
> be very welcome.

Peter: I am not being a contrarian, just being curious.

What is the utility of a log-me marker if all traffic is logged through a mechanism such as SIP CLF?

> It was commented at IETF#86 that a security analysis is needed so I 
> would like to understand if any scenarios exist with potential 
> security threats in order to add them to requirements. In many cases, 
> a network simply logs the signalling that passes through it so no new 
> security issues are created. Collecting end-to-end logging for 
> signalling that crosses multiple networks must not compromise security 
> or privacy, but I would expect networks to remove any security 
> sensitive fields before forwarding signalling regardless of whether 
> that signalling is of interest to logging.

We went through discussions related to all of the above points during the SIP CLF work.  See the Security Consideration section of [1]; it may provide you some answers.

[1] http://tools.ietf.org/html/rfc6872

Thanks,

- vijay
--
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60563 (USA)
Email: vkg@{bell-labs.com,acm.org} / [e-mail]
Web: http://ect.bell-labs.com/who/vkg/  | Calendar: http://goo.gl/x3Ogq _______________________________________________
dispatch mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dispatch
_______________________________________________
dispatch mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dispatch