[sip-clf] Scope of SIP-CLF problem

Cullen Jennings <fluffy@cisco.com> Tue, 12 January 2010 22:11 UTC

Return-Path: <fluffy@cisco.com>
X-Original-To: sip-clf@core3.amsl.com
Delivered-To: sip-clf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B4DC73A6849 for <sip-clf@core3.amsl.com>; Tue, 12 Jan 2010 14:11:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -110.599
X-Spam-Level:
X-Spam-Status: No, score=-110.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dj3q+GUR0zY2 for <sip-clf@core3.amsl.com>; Tue, 12 Jan 2010 14:11:35 -0800 (PST)
Received: from sj-iport-5.cisco.com (sj-iport-5.cisco.com [171.68.10.87]) by core3.amsl.com (Postfix) with ESMTP id 9F89E3A67F3 for <sip-clf@ietf.org>; Tue, 12 Jan 2010 14:11:35 -0800 (PST)
Authentication-Results: sj-iport-5.cisco.com; dkim=neutral (message not signed) header.i=none
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: ApoEAEKCTEurR7Hu/2dsb2JhbADBeJR6hDAE
X-IronPort-AV: E=Sophos;i="4.49,264,1262563200"; d="scan'208";a="132253727"
Received: from sj-core-5.cisco.com ([171.71.177.238]) by sj-iport-5.cisco.com with ESMTP; 12 Jan 2010 22:11:33 +0000
Received: from [192.168.4.177] (rcdn-fluffy-8711.cisco.com [10.99.9.18]) by sj-core-5.cisco.com (8.13.8/8.14.3) with ESMTP id o0CMAbjK000227 for <sip-clf@ietf.org>; Tue, 12 Jan 2010 22:11:33 GMT
From: Cullen Jennings <fluffy@cisco.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Impp: xmpp:cullenfluffyjennings@jabber.org
Date: Tue, 12 Jan 2010 15:11:32 -0700
Message-Id: <BE9553A2-4989-4E7C-AC95-2B852E782077@cisco.com>
To: SIP-CLF Mailing List <sip-clf@ietf.org>
Mime-Version: 1.0 (Apple Message framework v1077)
X-Mailer: Apple Mail (2.1077)
Subject: [sip-clf] Scope of SIP-CLF problem
X-BeenThere: sip-clf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <sip-clf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sip-clf>
List-Post: <mailto:sip-clf@ietf.org>
List-Help: <mailto:sip-clf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 12 Jan 2010 22:11:41 -0000

The charter highly constrains the solution space - specifically it assume the solution to the problem is a log file with a comment format. It was very intentional to charter the WG in a highly constrained way. The goal was to make the work small enough that something could get done with the energy available to get the work from idea, to standard, to implemented, to deployed. 

Now one can argue that it was completely misguided to slice up the solution space this way and but we had long discussions with meeting time and eventually came to rough consensus to go this way. I do not want us to continually revisit past decisions or we will never get anything done - we have had that problem on some sipping drafts in the past. At some point if we decide that a CLF is so limited that it has no use to standardize or build, I'm fine to go kill the whole thing and hit the reset button. Right now, I don't see us as close to that. The goal is to have it succeed (or fail) quickly. 

In defense of the current charter, clearly a log file format will not solve many of the management problem experienced in SIP networks. Clearly they are not appropriate for some types of devices. However, log files are one of the major tools used to debug SIP deployments and today they are mostly close but different which does not help with tools that look at them.  I think there is a reasonable percentage of people that believe that something simple could help. These people point out the value brought by existing tools that can parse an Apache log file or a PCAP dump. The assumption is that we have a log files for many things and they are used for some of the problems in the draft-gurbani-sipclf-problem-statement draft. The "problem" is that we don't have a common format for the log files. I realize that one could argue that the root cause of the problem are much more generic network management issues. However, people did not have the time or energy to take on the broader issues of improving operations of SIP networks. Instead they decided to try and fix this one tiny bit of the problem. I do believe that log files are more widely used that other things such as SNMP for managing SIP networks so I buy into the idea that this is a reasonable place to make a tiny bite sized incremental improvement to the situation.