Re: [sip-clf] draft CLF charter

"Romascanu, Dan (Dan)" <dromasca@avaya.com> Wed, 22 July 2009 15:47 UTC

Return-Path: <dromasca@avaya.com>
X-Original-To: sip-clf@core3.amsl.com
Delivered-To: sip-clf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C64BC3A6949 for <sip-clf@core3.amsl.com>; Wed, 22 Jul 2009 08:47:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.188
X-Spam-Level:
X-Spam-Status: No, score=-2.188 tagged_above=-999 required=5 tests=[AWL=0.411, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RQOozyrvAcYV for <sip-clf@core3.amsl.com>; Wed, 22 Jul 2009 08:47:45 -0700 (PDT)
Received: from co300216-co-outbound.net.avaya.com (co300216-co-outbound.net.avaya.com [198.152.13.100]) by core3.amsl.com (Postfix) with ESMTP id D54A23A6929 for <sip-clf@ietf.org>; Wed, 22 Jul 2009 08:47:44 -0700 (PDT)
X-IronPort-AV: E=Sophos;i="4.43,247,1246852800"; d="scan'208";a="177670129"
Received: from unknown (HELO co300216-co-erhwest.avaya.com) ([198.152.7.5]) by co300216-co-outbound.net.avaya.com with ESMTP; 22 Jul 2009 11:45:44 -0400
Received: from unknown (HELO 307622ANEX5.global.avaya.com) ([135.64.140.12]) by co300216-co-erhwest-out.avaya.com with ESMTP; 22 Jul 2009 11:45:43 -0400
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Wed, 22 Jul 2009 17:45:24 +0200
Message-ID: <EDC652A26FB23C4EB6384A4584434A0401893076@307622ANEX5.global.avaya.com>
In-Reply-To: <F3298CA2E6E14FB3BA1B5234ACF402FC@china.huawei.com>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [sip-clf] draft CLF charter
thread-index: AcoK4KfZzNfNxEVnT/2kAOLMye5ViwAAf2Ng
References: <3B33A97D-7E19-4A08-A431-A085D53A2A6E@nostrum.com> <D5E606B8-0811-4D40-AA76-ED989B00FD02@nostrum.com><EDC652A26FB23C4EB6384A4584434A0401892AF4@307622ANEX5.global.avaya.com><4A664053.7070603@alcatel-lucent.com><CB8F8D6E-5908-446A-84B1-B4FF84010F06@nostrum.com> <F3298CA2E6E14FB3BA1B5234ACF402FC@china.huawei.com>
From: "Romascanu, Dan (Dan)" <dromasca@avaya.com>
To: "Spencer Dawkins" <spencer@wonderhamster.org>, "SIP-CLF Mailing List" <sip-clf@ietf.org>
Subject: Re: [sip-clf] draft CLF charter
X-BeenThere: sip-clf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <sip-clf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sip-clf>
List-Post: <mailto:sip-clf@ietf.org>
List-Help: <mailto:sip-clf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Jul 2009 15:47:45 -0000

I need to have a more careful look, but the answer I think is No, the
argument is different. IPFIX defines information elements based on
packets inspection that characterize a 'flow' - in a SIP you cannot
differentiate packets that belong to different sessions only based on
on-wire information, so the definition of an IPFIX Information Element
(IE) may have too little or too much granularity for what we need. 

But, again, I need to read the CLF requirements and cross-match these
carefully with the IPFIX capabilities to make sure that I am not passing
a too easy judgment. 

Dan


> -----Original Message-----
> From: sip-clf-bounces@ietf.org 
> [mailto:sip-clf-bounces@ietf.org] On Behalf Of Spencer Dawkins
> Sent: Wednesday, July 22, 2009 6:05 PM
> To: SIP-CLF Mailing List
> Subject: Re: [sip-clf] draft CLF charter
> 
> Just to stay on the same page :D
> 
> I had a short chat with Dave Harrington Monday, and he asked 
> "why not IPFIX?" - has anyone looked at IPFIX yet?
> 
> I know Glen Zorn's question in February was "why not SYSLOG?" 
> - the answer then, from Eric Burger, was (paraphrasing) 
> "SYSLOG's the envelope, CLF might use SYSLOG but needs to 
> define what goes in the envelope".
> 
> The answer may be the same for IPFIX, and we'll probably need 
> to figure this out, but if anyone has already looked at this, 
> that would be great to know.
> 
> Thanks,
> 
> Spencer
> 
> 
> > Just to make sure we are all on the same page:
> >
> > On Jul 21, 2009, at 5:25 PM, Vijay K. Gurbani wrote:
> >
> >> Romascanu, Dan (Dan) wrote:
> >>> A few comments after the first reading of the charter.
> >>
> >> Dan: Thanks for your feedback; more inline.
> >>
> >>> - Is it Common Log File as it appears at the first instance, or  
> >>> Common Log Format?
> >>
> >> CLF expands to Common Log File, though colloquially you will see 
> >> references to "the CLF format", which simply means the specific 
> >> fields and their representation.
> >
> > This is something we need to state more clearly.
> >
> > Are we defining a file are we defining a format that might 
> go in a file?
> >
> > I think the proposals I've read so far are trying to do the second.
> > Does anyone disagree?
> >
> > I was planning to  change the word File Dan is pointing  to in the 
> > proposed charter to Format.
> >
> > RjS
> > _______________________________________________
> > sip-clf mailing list
> > sip-clf@ietf.org
> > https://www.ietf.org/mailman/listinfo/sip-clf
> 
> _______________________________________________
> sip-clf mailing list
> sip-clf@ietf.org
> https://www.ietf.org/mailman/listinfo/sip-clf
>