Re: [sip-clf] ASCII Logging

["Vijay K. Gurbani" <[e-mail]>]

On 11/14/2010 04:46 AM, Peter Musgrave wrote:
> (as individual)
>
> A couple of questions:
>
> 1) Do we want to keep this index pointers for this format (or was
> that just "index envy" to put the proposal on the same footing as
> IPFIX?)

No, it was not index envy.  IPFIX discussions arose much later
in the evolution of the work.

Whether or not to keep the index pointers is now for the WG to
decide.  There are advantages and disadvantages that folks are
already aware of and I am okay with going either way (i.e.,
with indexes or without.)

However, at the very least I think that we should keep the length
index to allow a reader to skip the entire record expeditiously
it does not match the Call-ID or dialogue-ID that is being sought.

> 2) If a field cannot be parsed a log entry would still be useful
> (src/dst should always be present). What should be logged for a field
> which failed to parse? "X" ?

We could put a "?" in fields that could not be parsed.

A "?" can appear in a SIP-URI production rule, however, an un-adorned
"?" as the only character in a SIPCLF field probably is a good
indication that something went wrong.

> 3) (Admittedly an odd case). If a tag (or other field) is literally
> "-" then it will be interpreted as missing. (Likewise if "X" from
> above is adopted). Do we need to do an escape sequence for a literal
> "-" or "X" ??

The "?" cannot appear in a tag.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/