Re: [sip-clf] ASCII Logging

[Hadriel Kaplan <[e-mail]>]

On Nov 14, 2010, at 5:46 AM, Peter Musgrave wrote:
> 
> 1) Do we want to keep this index pointers for this format (or was that just "index envy" to put the proposal on the same footing as IPFIX?)

No, get rid of the index line.  Make it easily readable by humans and grep. (since that's the main benefit of ascii)


> 2) If a field cannot be parsed a log entry would still be useful (src/dst should always be present). What should be logged for a field which failed to parse? "X" ?

Yeah we should pick one.  The character X makes as much sense as anything.


> 3) (Admittedly an odd case). If a tag (or other field) is literally "-" then it will be interpreted as missing. (Likewise if "X" from above is adopted). Do we need to do an escape sequence for a literal "-" or "X" ??

That's because the fields aren't being wrapped with a "", which is what Apache's CLF does for fields which are strings from the message.  That way a received dash would be "-", whereas a indication of none would be just the dash -, and indication of unparseable would be just the character X.

I propose that the ascii format make all fields which are interpreted/derived not use "", but all fields which are the literal string use "".

So a log entry would look like:
<allOneLine>
0000000000.010 1 INVITE - "sip:192.168.217.74;foo=bar" 192.168.217.74:5060 192.168.217.117:56485 "sip:192.168.217.74" - "sip:[e-mail]" "DL88360fa5fc" "[e-mail]" server-tx client-tx
</allOneLine>