Re: [sip-clf] A syslog approach to sip logging

["Vijay K. Gurbani" <[e-mail]>]

Spencer Dawkins wrote:
> Speaking as individual,
> 
> Just as a heads-up, David and I had a private conversation late last 
> week, where David told me that he did some investigation after our 
> Hiroshima meeting, and discovered (to his surprise) that it's fairly 
> common to use SYSLOG for Apache CLF.

As far as I know, only the error messages in Apache CLF go to
syslog [1] (someone can correct me if I am wrong.)  The CLF
logs are still saved on disk.

> I'm very interested in hearing reactions to this note, because it makes 
> me much more comfortable with our charter - most of our chartered work 
> is to identify fields that need to be logged and figure out a story for 
> correlation; once we have identified the fields that should be logged, 
> IFF we agree that SYSLOG makes sense, defining SYSLOG structured data 
> elements for those fields should be pretty straightforward.

Note that syslog may not work when a web server (or SIP server) is
running on a small footprint device that is not able to contact
the syslog daemon.  In that case, the syslog records are probably
written to local cache

However, insofar as there is a default mode to producing Apache
CLF, it is produced as a disk file.  Also, syslog records are
typically small; SIP CLF records can get pretty big depending on
what all is being logged.

[1] Ben Laurie, "Apache: The Definitive Guide," 2e.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/