Re: [sip-clf] Defining Pros and Cons of ASCII/IPFIX

["Vijay K. Gurbani" <[e-mail]>]

On 10/27/2010 10:23 AM, Peter Musgrave wrote:
> Hi all,
>
> As co-chair I am looking for a way to make a determination about how
> to meet the groups decision to move forward with just one format in a
> WG which has good support for two formats.

Peter: I know I am beating a dead horse, but I do want to point out
that it seems incongruous to come up with one format in a WG that has
good support for two.

Anyway, please see inline.

> In my (personal) opinion I think the objective is to develop
> something that will be widely implemented. I would like to solicit
> input from a larger audience - but first I think we need to frame the
> pros and cons.
>
> I would like to suggest the following:
>
> 1) Use the list and the Beijing meeting to come to a consensus on the
>  pros and cons of each and the applications which may favour one
> format vs another.
>
> 2) Place these pros/cons on the WG Wiki [I can act as editor]

OK to above.

> 3) Solicit input from SIP Implementors - referring them to the WG
> WIki - use the Columbia sip-implementors, sipforum list and SIPT27

We need to solicit input from the larger log analysis community besides
groups related only to the IETF.

There is a Linked In group called "Log Analysis Professionals" group; we
could consider posting a survey there.  Plus, Usenix holds system log-
related workshops every year (see http://systemloganalysis.com/).  I
am sure that we can get some names of researchers (commercial as well
as academics) that work with system logs on a daily basis and approach
them for viewpoints (I would be willing to do this if we decide to
follow through with 3 above.)

> 4) Review the feedback and try to come to a conclusion on the list
> (or failing that, in Prague at IETF80)
>
> I will be at SIPIT27 - so I can raise awareness of this discussion in
>  that community.
>
> How do people feel about this approach?
>
> I welcome any other/additional ways to resolve this issue.

My $0.02 --- have both.  At the risk of raising RjS's ire, the
hum we took in the Anaheim meeting [1] indicated support for
both (at least it does to my sensibilities.)  For reasons I
don't quite understand, we went against that hum in Maastricht [2].

Both representations have good reasons to move forward as
they do backers and people who are willing to work on them.  I
understand the need to avoid the H.248/Megaco debate, but we
should not be blind to the fact that SIP CLF maybe a different
nail that should not be hit by the same hammer.

Having constant arguments on which is better and why we should
only pick one when two seem a better option are simply
counter-productive.

[1] http://www.ietf.org/proceedings/77/minutes/sipclf.htm
[2] http://www.ietf.org/proceedings/78/minutes/sipclf.txt

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/