Re: [sip-clf] FW: New Version Notification for draft-niccolini-sipclf-ipfix-02

"Saverio Niccolini" <Saverio.Niccolini@nw.neclab.eu> Tue, 20 April 2010 14:35 UTC

Return-Path: <Saverio.Niccolini@nw.neclab.eu>
X-Original-To: sip-clf@core3.amsl.com
Delivered-To: sip-clf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EBB1C28C196 for <sip-clf@core3.amsl.com>; Tue, 20 Apr 2010 07:35:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.33
X-Spam-Level:
X-Spam-Status: No, score=-1.33 tagged_above=-999 required=5 tests=[AWL=1.269, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zoR337Zer4tK for <sip-clf@core3.amsl.com>; Tue, 20 Apr 2010 07:35:52 -0700 (PDT)
Received: from smtp0.neclab.eu (smtp0.neclab.eu [195.37.70.41]) by core3.amsl.com (Postfix) with ESMTP id 3159528C1D0 for <sip-clf@ietf.org>; Tue, 20 Apr 2010 07:33:39 -0700 (PDT)
Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp0.neclab.eu (Postfix) with ESMTP id 19C162C01C9F3; Tue, 20 Apr 2010 16:33:30 +0200 (CEST)
X-Virus-Scanned: Amavisd on Debian GNU/Linux (atlas2.office)
Received: from smtp0.neclab.eu ([127.0.0.1]) by localhost (atlas2.office [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1u1CUgE1cS+1; Tue, 20 Apr 2010 16:33:29 +0200 (CEST)
Received: from VENUS.office (mx1.office [192.168.24.3]) by smtp0.neclab.eu (Postfix) with ESMTP id E2B3D2C000C12; Tue, 20 Apr 2010 16:33:19 +0200 (CEST)
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Date: Tue, 20 Apr 2010 16:33:18 +0200
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="SHA1"; boundary="----=_NextPart_000_02D4_01CAE0A7.2EF1A8B0"
Message-ID: <547F018265F92642B577B986577D671C01381BAC@VENUS.office>
In-Reply-To: <4BCDB3C8.2020307@bell-labs.com>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Thread-Topic: [sip-clf] FW: New Version Notification for draft-niccolini-sipclf-ipfix-02
Thread-Index: Acrgkd+XQmo7VwAfQbWojS8Cg0fNrgAAOsyA
References: <547F018265F92642B577B986577D671C013819FF@VENUS.office> <4BCCD7A5.9090903@bell-labs.com> <547F018265F92642B577B986577D671C01381A7F@VENUS.office> <4BCDB3C8.2020307@bell-labs.com>
From: Saverio Niccolini <Saverio.Niccolini@nw.neclab.eu>
To: "Vijay K. Gurbani" <vkg@bell-labs.com>
Cc: SIP-CLF Mailing List <sip-clf@ietf.org>
Subject: Re: [sip-clf] FW: New Version Notification for draft-niccolini-sipclf-ipfix-02
X-BeenThere: sip-clf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <sip-clf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sip-clf>
List-Post: <mailto:sip-clf@ietf.org>
List-Help: <mailto:sip-clf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 20 Apr 2010 14:35:54 -0000

Dear Vijay,

> > Here we need some clarifications:
> >
> > -- (in my opinion) you can not define a data model if you first do
> > not define an information model, the data model is a mapping of your
> > information model into particular data structures (it is like the
> "implementation" of the "concepts" defined in the information model,
> > the relationship needs first of all to be defined in the information 
> > model)
>
> Thanks for starting off the conversation.  So let's drill down
> a bit on this to uncover the details of these models.
>
> In SIPCLF, the information model seems fairly simple to me.  We have
> two entities -- a SIPCLF producer (proxy, UAC, UAS, B2BUA, Registrar,
> Redirect server) and a SIPCLF consumer.  There is a one-to-many
> relationship between the producer and consumer (i.e., for a single
> SIPCLF producer, many consumers may be interested in the content
> it is producing.)  The producer and consumer do not communicate
> directly with each other, where communications is defined as sending
> direct messages over some channel.  Rather, the producer and the
> consumer have a synchronous I/O relationship between them based on a
> shared resource --- the SIPCLF file.
>
> The information model does not seem to be too complex here, but
> perhaps I am missing something...?  Would such an information model
> work for ipfix?  Or do we need to include other entities in the
> mix, like the collector, etc.?

Well, I do not think what you described above is an information model,
at least not the way I mean it.

I would rather call it: "high level architecture", an information model
is something completely different (in my opinion):

-a- the information model is composed of information elements; for defining
these information elements, a template is used

for the SIPCLF a template for the information element would be something like:
-- name of the information element
-- description
-- data type
-- units
something like the first table in 
http://tools.ietf.org/html/draft-niccolini-sipclf-ipfix-02#section-5
(here we are missing units but we have name, description and data type)
to be univocally identified, data types needs to be defined (e.g., what a
string is, etc.)

-b- the information model defines also the way the information elements are
linked together in records:
one record has 1 (optional) element of name1, 1..4 elements of name2, etc.
something like the request record template that is also in the same section 5 
of
our draft

> > -- (in my opinion) Section 8. of your draft [1] contains a start to
> > the definition of information elements to be included in the
> > information model, the information elements are independent from the
> > particular data model chosen, the relationship needs still to be
> defined
>
> It seems --- and please do correct me if I am in error --- that you
> view S8 of [1] as an information model.  That was not my intent.  My
> intent was for it to be a data model; i.e., define in some detail
> the contents of the individual data elements that will be logged;
> i.e., the structure of data elements (including legal values for the
> contents of these) and the relationship among the data elements (and
> by relationship I mean the idea that the server transaction ID can
> be used to create a call-tree of the session as it forked.)

A data model for me is something that specifies how to encode the
elements of the information model.
E.g., binary (like MIB or IPFIX) or textual (like XML).

> > If you want to see what I mean by the differences between information
> > model and data model, you can refer to another piece of work I did
> for
> > the traceroute use case: http://tools.ietf.org/html/rfc5388
> > My understanding was that the information model should be common and
> > thus described in only one place, but we will have multiple data
> models
> > (one ASCII and one binary/IPFIX).
> >
> > What is your view on that?
>
> I scanned at rfc5388, and it seems that ipfix consider the data
> elements
> themselves to be the part of the information model.  I think that is
> where the disconnect is.  My view of information model is what I
> presented above -- a rough ER diagram.  The data model then drills
> down to the "byte order level" to fill in the details of the
> communication primitives between the entities.
>
> What needs to be logged --- the specific SIP headers, etc. --- needs
> to be defined at one place.  How they are logged --- indexed ASCII,
> ipfix --- will be described in separate drafts.  In other words, we
> cannot have indexed-ASCII draft accord one set of semantics to the
> server transaction ID while the ipfix accords a completely different
> set to the same logged header.

I agree with that. I think the problem here is just terminology, nothing more.

You are saying "information model" for what I think can be called "high level 
architecture"
You are saying "data model" for what I think can be called "information model 
plus data model"
You are saying "how they are logged" for what I think can be called "encoding 
formats"

I am fine with any definition, we just need to start speaking the same 
language to
avoid misunderstandings, what would you prefer in terms of terminology? I am
open to anything that makes sense.

> > Also: I do not think a problem statement draft is the right place to
> > place an information model and a data model, maybe we need separate
> drafts
> > for that.
> >
> > Maybe we need:
> > -- one problem statement
> > -- another draft where we describe the information model and the two
> data
> > models?
>
> I think we can revisit the drafts decision once we reach some
> consensus on the information model vs. data model.

Ok, after having seem your answer it seems you are driving towards:
-- one draft (yours) specifying the problem statement, the information
model and the data model (where the information model defines the 
relationships
among the information elements that are linked to particular data types)
-- other draft(s) specifying the encodings

My fear is that if your drafts describes problem statement, info model and
data model then is getting quite overloaded and my suggestion would be to
split this in two drafts, but we can discuss that later on, I agree.

Other than terminology, I will be happy to review and help defining your
information/data model and the information elements you are defining...

Let me know what you think,
Saverio

>
> Thoughts?
>
> Thanks,
>
> - vijay
> --
> Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
> 1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
> Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
> Web:   http://ect.bell-labs.com/who/vkg/

============================================================
Dr. Saverio Niccolini
Manager, Real-Time Communications Group
NEC Laboratories Europe, Network Research Division
Kurfuerstenanlage 36, D-69115 Heidelberg
Tel.     +49 (0)6221 4342-118
Fax:     +49 (0)6221 4342-155
e-mail:  saverio.niccolini@nw.neclab.eu
============================================================
NEC Europe Limited Registered Office: NEC House, 1 Victoria
Road, London W3 6BL Registered in England 2832014