Re: [sip-clf] A syslog approach to sip logging

["Rainer Gerhards" <[e-mail]>]

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On
> Behalf Of Hadriel Kaplan
> Sent: Thursday, February 04, 2010 5:17 AM
> To: Cullen Jennings; David B Harrington
> Cc: 'SIP-CLF Mailing List'
> Subject: Re: [sip-clf] A syslog approach to sip logging
> 
> 
> 
> > -----Original Message-----
> > From: [e-mail] [mailto:[e-mail]] On
> Behalf
> > Of Cullen Jennings
> > Sent: Wednesday, February 03, 2010 6:39 PM
> >
> > One requirement that I suspect you will find fairly universal about
> > transporting around SIP log like informations is that
> >
> > 1) it is reliable
> >
> > 2) we can include complete SIP messages. These can get very large.
> (Magnus
> > posted a 40k SDP to the mmusic awhile back, don't even ask how large
> > MESSAGE messages get in the wild)
> 
> Also, if it is required for it to support including complete SIP
> messages, then it has to support binary content, since those can be in
> SIP message bodies (e.g., ISUP, QSIG).

This is problematic, but could be done with some transformation rules. syslog
is *not* designed as a transfer protocol for binary data, even though it may
occasionally support it. If sip clf has a large binary content part, syslog
is probably wrong. Apache clf is a text format, so I did not yet think this
may be a problem.

How do you so far intended to write them out? My understanding so far was
that a sip clf log entry would be a set of values, terminated by a LF. But
binary data may contain LF. So don't you need to encode it in any case?

Rainer