Re: [sip-clf] IETF 76 Minutes posted -> IPFIX questions

Right, I agree with you.  The trouble is we really do want it for multiple purposes. :)

But then I'm one of the ones who think IPFIX _is_ the right way to go anyway, because it has solved the problems and there's no point re-inventing the wheel.  I think it's just a bit daunting to people at first because they see a bunch of big RFC docs and assume it means a lot of work or complexity in implementation.

As for your question of: "Where does SIP typically run? on hosts? on routers? on middleboxes? in embedded systems? Would these environments have the same resources that web server environments typically have?"
The answer is it runs on all the above, and no not all of them have the same resources as web server environments. (which you probably knew when you asked it ;)

-hadriel

> -----Original Message-----
> From: sip-clf-bounces@ietf.org [mailto:sip-clf-bounces@ietf.org] On Behalf
> Of David B Harrington
> Sent: Wednesday, December 02, 2009 8:36 AM
> To: 'SIP-CLF Mailing List'
> Subject: Re: [sip-clf] IETF 76 Minutes posted -> IPFIX questions
> 
> Hi,
> 
> I have a concern with sipclf.
> I have been looking at "How to have a successful BOF":
> 
> the goal of the
>    BOF is to demonstrate that the community has agreement that:
> 
>       - there is a problem that needs solving, and the IETF is the
> right
>         group to attempt solving it.
> 
>       - the scope of the problem is well defined and understood, that
>         is, people generally understand what the WG will work on (and
>         what it won't) and what its actual deliverables will be.
> 
> Note the emphasis on what ***problem*** needs to be solved.
> The sipclf community decided "we need a logging file format"
> That is not a clear problem description; that is a solution - a
> partial solution.
> 
> The members of the sipclf WG have very different problems they are
> trying to solve.
> Some want to dump everything so they can later grep to find entries.
> Some express concern about dumping everything and think maybe filters
> are needed to limit what gets dumped.
> Some want a dump from a single device.
> Some want to be able to reconstruct SIP conversations across multiple
> devices.
> 
> I do not think the WG has consensus on what ***problem*** is being
> solved.
> The appropriate file format to use for a solution depends a lot on
> what problem you are trying to solve, and how the information will get
> used (and possibly moved).
> 
> Some think the apache file format is a great starting place. I have
> concerns about modeling sipclf after a web-server logging format. Web
> servers typically run on hosts, with lots of CPU cycles and lots of
> disk storage. Very appropriate for logging EVERYTHING. Maybe I just
> don't know SIP well enough to understand the environments in which it
> runs. Where does SIP typically run? on hosts? on routers? on
> middleboxes? in embedded systems? Would these environments have the
> same resources that web server environments typically have?
> 
> IPFIX may not be the right solution. But IPFIX has considered issues
> of CPU impact, limited storage, filters to select subsets of
> information to log, how to move the data off the box quickly, etc. The
> sipclf WG has not done that analysis because it is starting with a
> presumption of what they want for a solution, apparently without
> agreement on the problem to be solved.
> 
> I question whether a simple ascii dump is the right answer. And I
> don't think the WG has done the necessary analysis of requirements
> based on the various problems to be solved, and the environments that
> must be supported.
> 
> dbh
> 
> 
> _______________________________________________
> sip-clf mailing list
> sip-clf@ietf.org
> https://www.ietf.org/mailman/listinfo/sip-clf