Re: [sip-clf] WGLC: SIPCLF ProblemStatement(draft-gurbani-sipclf-problem-statement-01)

"David Harrington" <> Wed, 03 February 2010 16:14 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 5A5273A6885 for <>; Wed, 3 Feb 2010 08:14:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id xT3PY1LHagpC for <>; Wed, 3 Feb 2010 08:14:30 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id B7E783A6864 for <>; Wed, 3 Feb 2010 08:14:29 -0800 (PST)
Received: from ([]) by with comcast id dSyi1d0041HzFnQ5CUFC5h; Wed, 03 Feb 2010 16:15:12 +0000
Received: from Harrington73653 ([]) by with comcast id dUFC1d00L284sdk3aUFCRh; Wed, 03 Feb 2010 16:15:12 +0000
From: "David Harrington" <>
To: "'Spencer Dawkins'" <>, "'Vijay K. Gurbani'" <>, <>
References: <><00ce01caa41e$fe5a5ef0$> <> <>
Date: Wed, 3 Feb 2010 11:15:11 -0500
Message-ID: <01eb01caa4ec$0fbe0930$>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 11
In-Reply-To: <>
Thread-Index: AcqkT2ZZTy4JoPXfRvuUrI67gfyFVwAmhj+Q
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
Subject: Re: [sip-clf] WGLC: SIPCLF ProblemStatement(draft-gurbani-sipclf-problem-statement-01)
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 03 Feb 2010 16:14:31 -0000


> -----Original Message-----
> From: Spencer Dawkins [] 
> That means that it's not up to Vijay and Dave to work this out, with

> everyone else cheering them on from the sidelines - please 
> feel free to send 
> text that the editor can incorporate, as we identify that we 
> have consensus 
> on it!

Let me be clear about my role here.
I am syslog wg chair, and know the syslog specs fairly well, but I am
not an operator, and I do not personally deploy syslog, and I do not
know the SIP specs intimately or deploy SIP. If I did, I would be an
active technical contributor to this group rather than just a
technical advisor.

My tendency is going to be to recommend using technologies I am aware
of that I think might fit the requirements. If you have a hammer,
every problem is a nail. As I read the problem-statement-01, my
impression is syslog and/or ipfix might fit well to meet certain
goals, however, it is highly possible that syslog and ipfix are WRONG
to solve the sipclf problem. 

As Technical Advisor - not as technical contributor - I recommend that
the WG consider syslog and ipfix seriously. My advice as Technical
Advisor is to do a real analysis about the applicability of existing
standards like syslog and ipfix to the various sip clf use cases. This
should not be just a cursory analysis; we spent probably less than one
minute talking about syslog at the last IETF meeting. The typical
response to ipfix has been "well, we don't really know much about
ipfix, so we don't think it's a good choice." Those are NOT real

I am concerned about the rush attitude of this WG. Let's not rush to
produce a new standard, when existing standards could be applied
reasonably well. 

David Harrington