Re: [sip-clf] WGLC: SIPCLF ProblemStatement(draft-gurbani-sipclf-problem-statement-01)

"Romascanu, Dan (Dan)" <dromasca@avaya.com> Wed, 03 February 2010 10:20 UTC

Return-Path: <dromasca@avaya.com>
X-Original-To: sip-clf@core3.amsl.com
Delivered-To: sip-clf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B6B7028C15A for <sip-clf@core3.amsl.com>; Wed, 3 Feb 2010 02:20:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.462
X-Spam-Level:
X-Spam-Status: No, score=-2.462 tagged_above=-999 required=5 tests=[AWL=0.137, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uwK+2dS2U0hc for <sip-clf@core3.amsl.com>; Wed, 3 Feb 2010 02:20:03 -0800 (PST)
Received: from p-us1-iereast-outbound-tmp.us1.avaya.com (p-us1-iereast-outbound-tmp.us1.avaya.com [135.11.29.16]) by core3.amsl.com (Postfix) with ESMTP id DC19128C14B for <sip-clf@ietf.org>; Wed, 3 Feb 2010 02:20:02 -0800 (PST)
X-IronPort-AV: E=Sophos;i="4.49,397,1262581200"; d="scan'208";a="2207440"
Received: from unknown (HELO p-us1-erheast.us1.avaya.com) ([135.11.50.53]) by p-us1-iereast-outbound-tmp.us1.avaya.com with ESMTP; 03 Feb 2010 05:20:43 -0500
X-IronPort-AV: E=Sophos;i="4.49,397,1262581200"; d="scan'208";a="427707513"
Received: from unknown (HELO 307622ANEX5.global.avaya.com) ([135.64.140.11]) by p-us1-erheast-out.us1.avaya.com with ESMTP; 03 Feb 2010 05:20:12 -0500
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Wed, 3 Feb 2010 11:20:05 +0100
Message-ID: <EDC652A26FB23C4EB6384A4584434A0401ED2CB9@307622ANEX5.global.avaya.com>
In-Reply-To: <4B68920B.5090908@alcatel-lucent.com>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [sip-clf] WGLC: SIPCLF ProblemStatement(draft-gurbani-sipclf-problem-statement-01)
Thread-Index: AcqkSoqQKllLupuWQqekGmD6tvza3gAbsssA
References: <7505A2C58D8F4FD88B47D10EA74649CD@china.huawei.com><00ce01caa41e$fe5a5ef0$0600a8c0@china.huawei.com> <4B68920B.5090908@alcatel-lucent.com>
From: "Romascanu, Dan (Dan)" <dromasca@avaya.com>
To: "Vijay K. Gurbani" <vkg@alcatel-lucent.com>, "David Harrington" <ietfdbh@comcast.net>, <sip-clf@ietf.org>
Subject: Re: [sip-clf] WGLC: SIPCLF ProblemStatement(draft-gurbani-sipclf-problem-statement-01)
X-BeenThere: sip-clf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <sip-clf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sip-clf>
List-Post: <mailto:sip-clf@ietf.org>
List-Help: <mailto:sip-clf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 03 Feb 2010 10:20:05 -0000

 
On this specific point, it does not look to me that the WG reached a
consensus on this decision, at least in what concerns syslog. IPFIX is
still analyzed you say. In any case I think that it would be good to
keep the analysis of the existing protocols session in the document even
after a decision is reached - describing shortly what in the respective
protocols matched and what did not match the requirements. 

Dan

> -----Original Message-----
> From: sip-clf-bounces@ietf.org 
> [mailto:sip-clf-bounces@ietf.org] On Behalf Of Vijay K. Gurbani
> 
> > This problem statement document lacks any analysis of existing 
> > protocols that might address the different problems people seek to 
> > address.
> 
> I strongly disagree.  Version -00 had a section entitled 
> "Relationship to other protocols" (c.f., Section 7, 
> http://tools.ietf.org/html/draft-gurbani-sipclf-problem-statem
ent-00#section-7).

In that we discuss syslog, IDMEF, IPFIX and PCAP.  In Hiroshima during
the meeting we decided that syslog was not a good fit (simply because of
the number of messages that would need to be logged.)  I believe that
syslog is a good solution if one wants to enunciate messages based on
severity, etc.  In SIP CLF, the intent is to log the summary of *every*
SIP message.  A SIP server can still use syslog to send out critical
messages for the NOC, but using it as a substitute for CLF is probably
overkill.

No one spoke up for IDMEF, and the proponent of PCAP decided not to
pursue it.  That left IPFIX, which has a dedicated block of people
looking at it.  Thus in version -01, I did not put in a section
analyzing other protocols since it appeared to me that we had reached a
decision on what to do with syslog, IDMEF and IPFIX.