Re: [sip-clf] WGLC: SIPCLF ProblemStatement(draft-gurbani-sipclf-problem-statement-01)

["Romascanu, Dan (Dan)" <[e-mail]>]

 
On this specific point, it does not look to me that the WG reached a
consensus on this decision, at least in what concerns syslog. IPFIX is
still analyzed you say. In any case I think that it would be good to
keep the analysis of the existing protocols session in the document even
after a decision is reached - describing shortly what in the respective
protocols matched and what did not match the requirements. 

Dan

> -----Original Message-----
> From: [e-mail] 
> [mailto:[e-mail]] On Behalf Of Vijay K. Gurbani
> 
> > This problem statement document lacks any analysis of existing 
> > protocols that might address the different problems people seek to 
> > address.
> 
> I strongly disagree.  Version -00 had a section entitled 
> "Relationship to other protocols" (c.f., Section 7, 
> http://tools.ietf.org/html/draft-gurbani-sipclf-problem-statem
ent-00#section-7).

In that we discuss syslog, IDMEF, IPFIX and PCAP.  In Hiroshima during
the meeting we decided that syslog was not a good fit (simply because of
the number of messages that would need to be logged.)  I believe that
syslog is a good solution if one wants to enunciate messages based on
severity, etc.  In SIP CLF, the intent is to log the summary of *every*
SIP message.  A SIP server can still use syslog to send out critical
messages for the NOC, but using it as a substitute for CLF is probably
overkill.

No one spoke up for IDMEF, and the proponent of PCAP decided not to
pursue it.  That left IPFIX, which has a dedicated block of people
looking at it.  Thus in version -01, I did not put in a section
analyzing other protocols since it appeared to me that we had reached a
decision on what to do with syslog, IDMEF and IPFIX.