Re: [sip-clf] New CLF Syntax draft (text with index)

Adam Roach <> Thu, 07 May 2009 19:19 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 91DAB28C33F for <>; Thu, 7 May 2009 12:19:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.565
X-Spam-Status: No, score=-2.565 tagged_above=-999 required=5 tests=[AWL=0.035, BAYES_00=-2.599, SPF_PASS=-0.001]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 8+JXWlVWPfJQ for <>; Thu, 7 May 2009 12:19:12 -0700 (PDT)
Received: from ( [IPv6:2001:470:1f03:267::2]) by (Postfix) with ESMTP id C935228C32B for <>; Thu, 7 May 2009 12:18:51 -0700 (PDT)
Received: from [] ( []) (authenticated bits=0) by (8.14.3/8.14.3) with ESMTP id n47JKH2i074260 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 7 May 2009 14:20:18 -0500 (CDT) (envelope-from
Message-ID: <>
Date: Thu, 07 May 2009 14:20:17 -0500
From: Adam Roach <>
User-Agent: Postbox 1.0b11 (Macintosh/2009041623)
MIME-Version: 1.0
To: Simon Perreault <>
References: <> <>
In-Reply-To: <>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Received-SPF: pass ( is authenticated by a trusted mechanism)
Subject: Re: [sip-clf] New CLF Syntax draft (text with index)
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 07 May 2009 19:19:13 -0000

Simon Perreault wrote:
> Adam Roach wrote, on 07/05/09 02:56 PM:
>> This is about a 20% premium over the binary format, and a 48% premium
>> over the text format. Speed of generation should be on the same order of
>> speed as the other two versions, and speed of processing should be
>> approximately the same as processing binary.
> Iteresting! Thanks for writing this.
> Why did you include pointers as well as lengths? It seems to me that length is
> redundant, since you can deduce it by computing the difference between two
> pointers (still an O(1) operation).

I considered doing it both ways, but decided that I preferred the slight 
space impact of being able to get to any fixed field by looking at only 
two numbers instead of all the preceding fields. I'm open to doing just 
lengths if people are very sensitive to the size of each record, but 
have a personal preference for what's in the draft currently.