[sip-clf] Fw: [dispatch] Room for DISPATCH ad-hoc on CLF : Room 300 overLunchon Friday

["Spencer Dawkins" <[e-mail]>]

My apologies - I mistyped the SIP-CLF mailing list userpart on my note 
below. Hopefully everyone is also subscribed to the DISPATCH mailing list, 
which I DID type correctly :-/

Thanks,

Spencer

----- Original Message ----- 
From: "Spencer Dawkins" <[e-mail]>
To: "dispatch mailing list" <[e-mail]>
Cc: <[e-mail]>
Sent: Thursday, July 30, 2009 12:14 AM
Subject: Re: [dispatch] Room for DISPATCH ad-hoc on CLF : Room 300 
overLunchon Friday


> The SIP-CLF DISPATCH ad hoc on Friday is intended to form a working group,
> and we'll be noodling over charter text that Robert has produced (in
> consultation with others) during the meeting.
>
> Just to make sure we're all on the same page, here's the charter text 
> we'll
> be discussing - please look it over BEFORE the meeting (and if you want to 
> talk about it on the [e-mail] mailing list before the meeting, 
> that's fine, too):
>
> The SIP Common Log Format (CLF) working group is chartered to define a
> standard logging format for systems processing SIP messages.
>
> Well-known web servers such as Apache and web proxies like Squid support
> event logging using a common log format. The logs produced using these
> de-facto standard formats are invaluable to system administrators for
> trouble-shooting a server and tool writers to craft tools that mine the 
> log
> files to produce reports and trends and to search for a certain SIP 
> message
> or messages, a transaction or a related set of transactions. Furthermore,
> these log records can also be used to train anomaly detection systems and
> feed events into a security event management system.
>
> The Session Initiation Protocol does not have a common log format. Diverse
> element provide distinct log formats making it complex to produce tools to
> analyze them.
>
> The CLF working group will produce a format suitable for logging from any
> SIP element. The format will anticipate the need to search, merge, and
> summarize the log records from diverse elements. The format will 
> anticipate
> the need to correlate messages from multiple elements related to a given
> request (that may fork) or a given dialog. The format will take SIP's
> extensibility into consideration, providing a way to represent SIP message
> components that are defined in the future. The format will anticipate 
> being
> used both for off-line analysis and on-line real-time processing
> applications. The working group will consider the need for efficient
> creation of records and the need for efficient processing of the records.
>
> The working group will identify the fields to appear in a log record and
> provide one or more formats for encoding those fields. The working group 
> is
> not pre-constrained to producing either a bit-field oriented or
> text-oriented format, and may choose to provide both. If the group chooses
> to specify both, it must be possible to mechanically translate between the
> formats without loss of information.
>
> Specifying the mechanics of exchanging, transporting, and storing SIP
> Common Log Format records is explicitly out of scope. Specifying a 
> real-time
> transfer mechanism for heuristic analysis is explicitly out of scope.
>
> The group will generate:
>
> A problem statement enunciating the motivation, and use cases for a SIP
> Common Log Format. This analysis will identify the required minimal
> information that must appear in any record.
>
> A specification of the SIP Common Log Format record
>
> The group will consider providing one or more reference implementations 
> for
> decoding a CLF record.
>
> One more piece of logistics ...
>
> We'll need at least one, and preferably two, scribes and a jabber scribe 
> for
> our CLF session on Friday during lunch.
>
> We'll call for volunteers at the meeting if necessary - we can't have the
> meeting without producing minutes - but it would be great if you could
> consider volunteering NOW.
>
> We have about an hour to get through some pretty important discussions, 
> and
> every minute we DON'T spend gazing meaningfully at the attendees (us) and
> looking down at computers trying not to make eye contact with the chairs
> (you) is a minute that we can use more productively!
>
> Thanks,
>
> Spencer and Theo
>
> _______________________________________________
> dispatch mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dispatch