Re: SIP CLF Format

Dale Worley wrote:
> On Thu, 2009-02-05 at 16:56 -0600, Vijay K. Gurbani wrote:
>> It's purpose is much the same as the Apache CLF format: it is
>> not used as much to debug as it is used for trend analysis and
>> anomaly detection.
> 
> Which means that the intended consumer of CLF is software, not humans.

Dale: I will agree that the preponderance of usage will be for
automata, but it benefits the human user as well to see the CLF
entries being produced in real-time.  IT departments routinely
keep a (human) eye on the Apache CLF as a sanity check, if not
anything else.

> In that case, I would recommend making CLF as *uniform* as possible,
> which suggests that it *always* log either transactions (one line
> documenting request and final response), or messages (one line for each
> request and response). 

But this is hard to do given how SIP works.  For instance, if an
automata is being trained, it helps to have the provisional
responses being logged before a final is seen.  In the event that
we use a one line documenting request and final response, we
loose this critical piece of state machinery.  Likewise, for a
proxy that forks, representing the forked branches and their
machinations in one line is near impossible.

> Allowing two varieties increases the complexity
> of the consumer.

I do agree, but unfortunately the complexity is unavoidable
given how the protocol works.

Thanks,

- vijay
--

-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg <at> {alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/
_______________________________________________
Sipping mailing list  https://www.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use sip-implementors <at> cs.columbia.edu for questions on current sip
Use sip <at> ietf.org for new developments of core SIP