Re: [sip-clf] SIP-CLF slides for opsarea and possibly ipfix

Hadriel Kaplan <HKaplan@acmepacket.com> Fri, 24 July 2009 17:41 UTC

Return-Path: <HKaplan@acmepacket.com>
X-Original-To: sip-clf@core3.amsl.com
Delivered-To: sip-clf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 24CEE3A6B01 for <sip-clf@core3.amsl.com>; Fri, 24 Jul 2009 10:41:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rrNrfdVbluXu for <sip-clf@core3.amsl.com>; Fri, 24 Jul 2009 10:41:19 -0700 (PDT)
Received: from etmail.acmepacket.com (etmail.acmepacket.com [216.41.24.6]) by core3.amsl.com (Postfix) with ESMTP id 9BC9A3A6A13 for <sip-clf@ietf.org>; Fri, 24 Jul 2009 10:41:18 -0700 (PDT)
Received: from mail.acmepacket.com (216.41.24.7) by etmail.acmepacket.com (216.41.24.6) with Microsoft SMTP Server (TLS) id 8.1.375.2; Fri, 24 Jul 2009 13:41:16 -0400
Received: from mail.acmepacket.com ([127.0.0.1]) by mail ([127.0.0.1]) with mapi; Fri, 24 Jul 2009 13:41:16 -0400
From: Hadriel Kaplan <HKaplan@acmepacket.com>
To: "Vijay K. Gurbani" <vkg@alcatel-lucent.com>, "sip-clf@ietf.org" <sip-clf@ietf.org>
Date: Fri, 24 Jul 2009 13:41:15 -0400
Thread-Topic: [sip-clf] SIP-CLF slides for opsarea and possibly ipfix
Thread-Index: AcoMewhSCE45pU3/S2actHFv57HzhwABjPHg
Message-ID: <E6C2E8958BA59A4FB960963D475F7AC31984654C6C@mail>
References: <4A69DFBB.3010307@alcatel-lucent.com>
In-Reply-To: <4A69DFBB.3010307@alcatel-lucent.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [sip-clf] SIP-CLF slides for opsarea and possibly ipfix
X-BeenThere: sip-clf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <sip-clf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sip-clf>
List-Post: <mailto:sip-clf@ietf.org>
List-Help: <mailto:sip-clf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 24 Jul 2009 17:41:20 -0000

Hi Vijay,

I would recommend the following changes:

1) Get rid of the two slides on "Need for CLF in current literature".  Neither of those two use-cases are actually addressed by SIP CLF, afaict.  At least not for the purpose of performing anomaly detection by using the CLF. (CLF would be useful to report when anomalous events are found perhaps, but we've said it's not a replacement for Syslog/SNMP event reporting, right?)  Even if you don't agree with my view of that, there's no need to debate it in the meeting, because it's not central to the need for CLF.

2) Maybe summarize the proposed charter in a slide or two?  Like list what's in/out-of-scope, and the deliverables?

3) on the last slide, include opsarea in the parenthesis list, since that's planned for Stockholm as well I believe.

4) I'm not quite sure what the purpose of the "Challenges in defining SIP CLF" slides are, but if you're itemizing them... then add "To get a common view of merged/global CLF's, must choose where in the stack/system to log SIP messages", and "Security and privacy related issues of various forms".

5) editorial nit: slide 3, remove the word "problem" from the top, since this is a slide on benefits, not problems. Unless you're saying the problem is we don't have these benefits. ;)

-hadriel


> -----Original Message-----
> From: sip-clf-bounces@ietf.org [mailto:sip-clf-bounces@ietf.org] On Behalf
> Of Vijay K. Gurbani
> 
> Hello: Here is a link to the slide show I plan to present
> on SIP-CLF at the opsarea meeting on Thu.  An abbreviated
> version of this may be presented at the ipfix meeting
> on Mon as well.
> 
> Please do look at the contents and suggest any changes.
> 
> http://ect.bell-labs.com/who/vkg/IETF/75/IETF-75-sip-clf-vkg.ppt
>