Re: [sip-clf] Request for Consensus: Adopt ASCII

"Vijay K. Gurbani" <vkg@bell-labs.com> Thu, 02 December 2010 20:19 UTC

Return-Path: <vkg@bell-labs.com>
X-Original-To: sip-clf@core3.amsl.com
Delivered-To: sip-clf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BDA5228C18C for <sip-clf@core3.amsl.com>; Thu, 2 Dec 2010 12:19:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.17
X-Spam-Level:
X-Spam-Status: No, score=-106.17 tagged_above=-999 required=5 tests=[AWL=0.429, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FsfyNcWOSiOm for <sip-clf@core3.amsl.com>; Thu, 2 Dec 2010 12:19:13 -0800 (PST)
Received: from ihemail1.lucent.com (ihemail1.lucent.com [135.245.0.33]) by core3.amsl.com (Postfix) with ESMTP id 5F9193A6981 for <sip-clf@ietf.org>; Thu, 2 Dec 2010 12:19:13 -0800 (PST)
Received: from umail.lucent.com (h135-3-40-63.lucent.com [135.3.40.63]) by ihemail1.lucent.com (8.13.8/IER-o) with ESMTP id oB2KKT07005213 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for <sip-clf@ietf.org>; Thu, 2 Dec 2010 14:20:29 -0600 (CST)
Received: from shoonya.ih.lucent.com (Knoppix-135185238233.ih.lucent.com [135.185.238.233]) by umail.lucent.com (8.13.8/TPES) with ESMTP id oB2KKSaX025973 for <sip-clf@ietf.org>; Thu, 2 Dec 2010 14:20:29 -0600 (CST)
Message-ID: <4CF80007.3050700@bell-labs.com>
Date: Thu, 02 Dec 2010 14:22:31 -0600
From: "Vijay K. Gurbani" <vkg@bell-labs.com>
Organization: Bell Laboratories, Alcatel-Lucent
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.15) Gecko/20101027 Fedora/3.0.10-1.fc12 Thunderbird/3.0.10
MIME-Version: 1.0
To: "sip-clf@ietf.org" <sip-clf@ietf.org>
References: <D4134C23-AC3E-48E7-BFB4-1D51C2CA51EF@magorcorp.com> <06792DB6-BD48-42C9-B12F-639EA5E6E996@acmepacket.com> <6C54CABA-5BF0-4BA3-8845-1822023FF624@magorcorp.com> <4CDAAC6B.8090707@bell-labs.com> <5319F0AA-5CDE-42F0-BDC3-1A60FA18F2CF@voxeo.com> <745B2172-F6B4-4E3A-B92F-08904067354D@magorcorp.com> <0E35576E-3B0B-41A4-BB58-81207D71E983@cisco.com>
In-Reply-To: <0E35576E-3B0B-41A4-BB58-81207D71E983@cisco.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.57 on 135.245.2.33
Subject: Re: [sip-clf] Request for Consensus: Adopt ASCII
X-BeenThere: sip-clf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: SIP Common Log File format discussion list <sip-clf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sip-clf>
List-Post: <mailto:sip-clf@ietf.org>
List-Help: <mailto:sip-clf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sip-clf>, <mailto:sip-clf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Dec 2010 20:19:14 -0000

On 12/01/2010 12:47 AM, Gonzalo Salgueiro wrote:
> Peter -
>
> There might be value in converging as a group on many of these
> lingering issues that have recently been raised before submitting
> the -00 version of the WG doc.

Gonzalo: Here is some feedback from me on some of the items below,
partly in my role as a co-author and partly as a WG participant.

> These issues include:
>
> - Should we use indexing at all versus tab delimited? or should we
> stick with just pointers? or go with do away with the indexing but
> still log the field lengths?

I can go either way.  I see the benefit of indexing (fast searches.)
If we decide to go with tab delimiters (or space delimiters, as
Hadriel had suggested [1]), then we should ensure that a record
length appears in a fixed field to allow readers to skip records
that are not of interest.

> - Update the presentation of optional fields from something
> like:<mandatory fields>	01,07,foo.bar	02,0b,hello world      to
> something like:<mandatory fields>  1="foo.bar" 2="hello world"

I like the first one better.  The length allows quick reading and
skipping.

> - Should we add vendor specified fields in the optionally logged
> portion (using enterprise numbers or related mechanism)

Sounds reasonable.

> - What format do we use to log a field that cannot be parsed?

I had suggested a "?" in an earlier email; see [2].

> - How do we log a missing field? Stick with - and come up with some
> escape sequence for it? or do we log all fields which are
> interpreted/derived not use "", but all fields which are the literal
> string use " ?

Just stick a "?" in it as well.

> - While we have to consensus that logging bodies (SDP and otherwise)
> is capped at 4k and optional, how much of of this should be
> specified in the Problem Statement and how much in the ASCII draft?

Specifying the maximum length should be in the problem-statement draft.

> For something that is considered option, do we need to decide on how
> to represent a multi-line body in a format which tries to use a
> single text line?

Can we not just put the literal "\r\n" --- at least for SDP bodies,
since that is what most folks appear to want to log.  I doubt that
folks will log bodies consisting of GIF images or other binary
bodies.  The literal "\r\n" will also handle XML (won't be pretty,
but at least it'll be there.)

Thanks,

[1] http://www.ietf.org/mail-archive/web/sip-clf/current/msg00394.html
[2] http://www.ietf.org/mail-archive/web/sip-clf/current/msg00399.html

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/