[sip-clf] is doing ascii doing both? (was: Defining Pros and Cons of ASCII/IPFIX)

Hadriel Kaplan <HKaplan@acmepacket.com> Wed, 10 November 2010 05:55 UTC

Return-Path: <HKaplan@acmepacket.com>
X-Original-To: sip-clf@core3.amsl.com
Delivered-To: sip-clf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E67A13A6813 for <sip-clf@core3.amsl.com>; Tue, 9 Nov 2010 21:55:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.08
X-Spam-Level:
X-Spam-Status: No, score=-2.08 tagged_above=-999 required=5 tests=[AWL=0.519, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id do2qpFBiOno6 for <sip-clf@core3.amsl.com>; Tue, 9 Nov 2010 21:55:36 -0800 (PST)
Received: from etmail.acmepacket.com (etmail.acmepacket.com [216.41.24.6]) by core3.amsl.com (Postfix) with ESMTP id B7D273A689F for <sip-clf@ietf.org>; Tue, 9 Nov 2010 21:55:33 -0800 (PST)
Received: from mail.acmepacket.com (216.41.24.7) by etmail.acmepacket.com (216.41.24.6) with Microsoft SMTP Server (TLS) id 8.2.254.0; Wed, 10 Nov 2010 00:55:55 -0500
Received: from mail.acmepacket.com ([127.0.0.1]) by mail ([127.0.0.1]) with mapi; Wed, 10 Nov 2010 00:55:52 -0500
From: Hadriel Kaplan <HKaplan@acmepacket.com>
To: Cullen Jennings <fluffy@cisco.com>
Date: Wed, 10 Nov 2010 00:55:43 -0500
Thread-Topic: is doing ascii doing both? (was: Defining Pros and Cons of ASCII/IPFIX)
Thread-Index: AcuAm+5FTkhC5KTQRl6ZuRYDFrwHxw==
Message-ID: <730DDA83-EC15-48D0-99BD-68BB0DA0D90F@acmepacket.com>
References: <AANLkTin3+_+-ARa29=o4V8-Pp-TS0Xc5S04CYhy0sT=r@mail.gmail.com> <D2591488-77F2-423D-B2AE-187E627D4489@acmepacket.com> <752EDF9B02C09847950620E262C45431845234@PALLENE.office.hd> <AANLkTikQ-gV-tja_LnQx7X-4uScpnAi=oNVAj3xQe_2J@mail.gmail.com> <DF0E148F-CA21-4373-92FF-A777A27A76EE@cisco.com> <9172F3B8-339B-4F2A-B7DF-A620C408E934@acmepacket.com> <119C6B38-825F-4074-9D3C-8A91A8E3454D@cisco.com> <0AD10257-D7F7-42FB-8CC4-E4A4FB17F63F@acmepacket.com> <90B0774E-02D3-4FAD-94E8-2F560C11C32F@cisco.com>
In-Reply-To: <90B0774E-02D3-4FAD-94E8-2F560C11C32F@cisco.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: List SIP-CLF Mailing <sip-clf@ietf.org>
Subject: [sip-clf] is doing ascii doing both? (was: Defining Pros and Cons of ASCII/IPFIX)
X-BeenThere: sip-clf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <sip-clf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sip-clf>
List-Post: <mailto:sip-clf@ietf.org>
List-Help: <mailto:sip-clf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 10 Nov 2010 05:55:37 -0000

When Peter first proposed it I was basically thinking the same thing.  In a way, that's true in that if we go define IANA numbers for putting the field in IPFIX, then obviously one could then write the IPFIX message with such fields into a file.  But that'll be true no matter what we do, unless you're suggesting no protocol ever be allowed to encode the fields.  For example someone might submit an I-D to create IANA-defined DIAMETER AVPs for these fields; and someone may submit an I-D someday to write DIAMETER messages to a file.  How can we prevent that?  Why should we?

Having said all that, the more I'm thinking about it the more I'm thinking it's not _really_ "doing both".  Because I think Eric's right.  Those of us that need an exporting mechanism will do IPFIX, if there's some advantage to doing that for exporting such stuff.  I personally think there is, but that's really a separate topic.  But for literal local *file* format, I have no doubt Eric is right and ascii will dominate.  It's trivial to implement, and easy to read. (or will be if we get rid of the indexes)

So when you go to the Cisco marketing folks, you can tell them to use the single, ascii format we publish an RFC for. (whatever format that will be)

-hadriel

On Nov 9, 2010, at 11:22 PM, Cullen Jennings wrote:

>> The proposal Peter suggested was to pick Ascii.  Are you ok with that?
> 
> I'm fine with pick either but that was not the proposal. The proposal was effectively to pick both.