Re: [sip-clf] Last Call: <draft-ietf-sipclf-problem-statement-11.txt> (The Common Log Format (CLF) for the Session Initiation Protocol (SIP): Framework and Data Model) to Proposed Standard

"Vijay K. Gurbani" <vkg@bell-labs.com> Mon, 24 December 2012 19:03 UTC

Return-Path: <vkg@bell-labs.com>
X-Original-To: sip-clf@ietfa.amsl.com
Delivered-To: sip-clf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 972CD21F85CE; Mon, 24 Dec 2012 11:03:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -109.141
X-Spam-Level:
X-Spam-Status: No, score=-109.141 tagged_above=-999 required=5 tests=[AWL=1.458, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E0OVoaeOiV6s; Mon, 24 Dec 2012 11:03:07 -0800 (PST)
Received: from ihemail2.lucent.com (ihemail2.lucent.com [135.245.0.35]) by ietfa.amsl.com (Postfix) with ESMTP id AED7521F8599; Mon, 24 Dec 2012 11:03:07 -0800 (PST)
Received: from usnavsmail4.ndc.alcatel-lucent.com (usnavsmail4.ndc.alcatel-lucent.com [135.3.39.12]) by ihemail2.lucent.com (8.13.8/IER-o) with ESMTP id qBOJ33RA016878 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Mon, 24 Dec 2012 13:03:04 -0600 (CST)
Received: from umail.lucent.com (umail-ce2.ndc.lucent.com [135.3.40.63]) by usnavsmail4.ndc.alcatel-lucent.com (8.14.3/8.14.3/GMO) with ESMTP id qBOJ336a031581 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 24 Dec 2012 13:03:03 -0600
Received: from shoonya.ih.lucent.com (shoonya.ih.lucent.com [135.185.237.229]) by umail.lucent.com (8.13.8/TPES) with ESMTP id qBOJ32Q8015232; Mon, 24 Dec 2012 13:03:03 -0600 (CST)
Message-ID: <50D8A750.2020005@bell-labs.com>
Date: Mon, 24 Dec 2012 13:04:48 -0600
From: "Vijay K. Gurbani" <vkg@bell-labs.com>
Organization: Bell Laboratories, Alcatel-Lucent
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/17.0 Thunderbird/17.0
MIME-Version: 1.0
To: "Romascanu, Dan (Dan)" <dromasca@avaya.com>
References: <20121203204501.12217.39525.idtracker@ietfa.amsl.com> <9904FB1B0159DA42B0B887B7FA8119CA042028@AZ-FFEXMB04.global.avaya.com>
In-Reply-To: <9904FB1B0159DA42B0B887B7FA8119CA042028@AZ-FFEXMB04.global.avaya.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.57 on 135.245.2.35
X-Scanned-By: MIMEDefang 2.64 on 135.3.39.12
Cc: "sip-clf@ietf.org" <sip-clf@ietf.org>, "ietf@ietf.org" <ietf@ietf.org>
Subject: Re: [sip-clf] Last Call: <draft-ietf-sipclf-problem-statement-11.txt> (The Common Log Format (CLF) for the Session Initiation Protocol (SIP): Framework and Data Model) to Proposed Standard
X-BeenThere: sip-clf@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: SIP Common Log File format discussion list <sip-clf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sip-clf>
List-Post: <mailto:sip-clf@ietf.org>
List-Help: <mailto:sip-clf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 24 Dec 2012 19:03:08 -0000

Dan: Thank you for your review of the SIP CLF problem statement
draft.  I appreciate your time and resulting comments.

Please see inline on resolution of your comments.  I will be releasing
an updated version of the draft shortly with the resolutions contained
herein.

On 12/17/2012 10:02 AM, Romascanu, Dan (Dan) wrote:
> Hi,
>
> I believe that this is a good document and I support its approval.
>
> I do have a number of issues which I suggest to take into consideration before approval and publication:
>
> 1. In Section 4:
>
>   The SIP CLF is amenable to easy parsing and lends itself well to
>     creating other innovative tools.
>
> I am not sure what this sentence really says. What does 'easy parsing' mean? The previous paragraph referred to 'quick parsing (i.e., well-delimited fields)' - quick parsing is a relative notion but at least there was an example. Here, I do not know.
>
> What does 'other innovative tools' means escapes me totally. Why 'other'? 'other' than what? And what 'innovative tools' means?

I have changed the text to address your comment.  The change is as
follows:

OLD:

   The SIP CLF is amenable to easy parsing and lends itself well to
   creating other innovative tools.

NEW:

   Due to the structure imposed by delimited fields, the SIP CLF is
   amenable to easy parsing and lends itself well to creating other
   innovative tools such as logfile parsers and trend analytic engines.

> 2. In Section 11
>
>     SIP CLF log files will take up substantive amount of disk space
>     depending on traffic volume at a processing entity and the amount of
>     information being logged.  As such, any organization using SIP CLF
>     should establish operational procedures for file rollovers as
>     appropriate to the needs of the organization.
>
> Procedures for file rollovers is not enough - actually there need to be in place procedures for periodic retrieval of logs before rollover.

Added the phrase "periodic retrieval of logs before rollover" in S11.

> 3. [RFC3261] needs to be a Normative Reference. All this document speaks about logs for SIP, refers to SIP entities, messages, fields in the SIP messages - on short it cannot be understood and the SIP-CLF cannot be implemented without a good reading and understanding of [RFC3261].

I think it is a reasonable position that understanding rfc3261 is a pre-
requsite for implementing SIP CLF.  I have made rfc3261 normative as you
suggest.

Once again, thank you for your time and review of this work.

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60563 (USA)
Email: vkg@{bell-labs.com,acm.org} / vijay.gurbani@alcatel-lucent.com
Web:   http://ect.bell-labs.com/who/vkg/