Re: [sip-clf] New CLF Syntax draft (text with index)

Adam Roach <> Thu, 07 May 2009 19:28 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id CD24F28C1E7 for <>; Thu, 7 May 2009 12:28:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.566
X-Spam-Status: No, score=-2.566 tagged_above=-999 required=5 tests=[AWL=0.034, BAYES_00=-2.599, SPF_PASS=-0.001]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id umIjwuxpucun for <>; Thu, 7 May 2009 12:28:30 -0700 (PDT)
Received: from ( [IPv6:2001:470:1f03:267::2]) by (Postfix) with ESMTP id B71323A6A9A for <>; Thu, 7 May 2009 12:28:29 -0700 (PDT)
Received: from [] ( []) (authenticated bits=0) by (8.14.3/8.14.3) with ESMTP id n47JTtrZ074903 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 7 May 2009 14:29:56 -0500 (CDT) (envelope-from
Message-ID: <>
Date: Thu, 07 May 2009 14:29:55 -0500
From: Adam Roach <>
User-Agent: Postbox 1.0b11 (Macintosh/2009041623)
MIME-Version: 1.0
To: Simon Perreault <>
References: <> <> <> <>
In-Reply-To: <>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Received-SPF: pass ( is authenticated by a trusted mechanism)
Subject: Re: [sip-clf] New CLF Syntax draft (text with index)
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 07 May 2009 19:28:30 -0000

Simon Perreault wrote:
> Adam Roach wrote, on 07/05/09 03:20 PM:
>> I considered doing it both ways, but decided that I preferred the slight
>> space impact of being able to get to any fixed field by looking at only
>> two numbers instead of all the preceding fields. I'm open to doing just
>> lengths if people are very sensitive to the size of each record, but
>> have a personal preference for what's in the draft currently.
> I'm sorry, I don't understand. Why would one need to look at all the preceding
> fields?
> Let's say you want to look at field 3. You look up the third pointer (p3), this
> gives you the start of the field. Then you look up the fourth pointer (p4), this
> give you the end of the field. If you want the length you compute p4 - p3.

Ah, yes! That's a good point. I had considered encoding *lengths* only, 
which would require adding all the preceding fields together (and I had 
mis-read your suggestion to mean lengths instead of pointers). You are, 
of course, correct -- encoding only pointers gets me what I need, while 
cutting the index size in half. Thanks! I'll try to get a revised draft 
out reflecting this change sometime soon.