Re: [sip-clf] draft CLF charter

I need to have a more careful look, but the answer I think is No, the
argument is different. IPFIX defines information elements based on
packets inspection that characterize a 'flow' - in a SIP you cannot
differentiate packets that belong to different sessions only based on
on-wire information, so the definition of an IPFIX Information Element
(IE) may have too little or too much granularity for what we need. 

But, again, I need to read the CLF requirements and cross-match these
carefully with the IPFIX capabilities to make sure that I am not passing
a too easy judgment. 

Dan

> -----Original Message-----
> From: sip-clf-bounces@ietf.org 
> [mailto:sip-clf-bounces@ietf.org] On Behalf Of Spencer Dawkins
> Sent: Wednesday, July 22, 2009 6:05 PM
> To: SIP-CLF Mailing List
> Subject: Re: [sip-clf] draft CLF charter
> 
> Just to stay on the same page :D
> 
> I had a short chat with Dave Harrington Monday, and he asked 
> "why not IPFIX?" - has anyone looked at IPFIX yet?
> 
> I know Glen Zorn's question in February was "why not SYSLOG?" 
> - the answer then, from Eric Burger, was (paraphrasing) 
> "SYSLOG's the envelope, CLF might use SYSLOG but needs to 
> define what goes in the envelope".
> 
> The answer may be the same for IPFIX, and we'll probably need 
> to figure this out, but if anyone has already looked at this, 
> that would be great to know.
> 
> Thanks,
> 
> Spencer
> 
> 
> > Just to make sure we are all on the same page:
> >
> > On Jul 21, 2009, at 5:25 PM, Vijay K. Gurbani wrote:
> >
> >> Romascanu, Dan (Dan) wrote:
> >>> A few comments after the first reading of the charter.
> >>
> >> Dan: Thanks for your feedback; more inline.
> >>
> >>> - Is it Common Log File as it appears at the first instance, or  
> >>> Common Log Format?
> >>
> >> CLF expands to Common Log File, though colloquially you will see 
> >> references to "the CLF format", which simply means the specific 
> >> fields and their representation.
> >
> > This is something we need to state more clearly.
> >
> > Are we defining a file are we defining a format that might 
> go in a file?
> >
> > I think the proposals I've read so far are trying to do the second.
> > Does anyone disagree?
> >
> > I was planning to  change the word File Dan is pointing  to in the 
> > proposed charter to Format.
> >
> > RjS
> > _______________________________________________
> > sip-clf mailing list
> > sip-clf@ietf.org
> > https://www.ietf.org/mailman/listinfo/sip-clf
> 
> _______________________________________________
> sip-clf mailing list
> sip-clf@ietf.org
> https://www.ietf.org/mailman/listinfo/sip-clf
> 