Subject: Re: [dispatch] [Sipping] SIP-CLF: Results on ASCII vs. binary representation

From: Cullen Jennings <[email-masked]>
Date: Fri, 1 May 2009 06:23:16 -0600

On Apr 29, 2009, at 1:34 PM, Elwell, John wrote:

> p.s. which list - DISPATCH or SIP-OPS?

Folks, please use DISPATCH for this for now.

Thanks,
Cullen <in my RAI AD role>

ANd in gneraly, please, don't cross post whole threads if at all  
posible.

---

From: Dean Willis <[email-masked]>
Date: Fri, 1 May 2009 08:29:03 -0500

> Cullen <in my RAI AD role>

This isn't SIPPING.

Why are we having a technical conversation about defining a log format  
on the DISPATCH list?

Shouldn't the conversation here be about where to do the work and  
whether or not a new working group is needed to do that work?

It seems to me that a technical conversation belongs either on a WG  
list or perhaps on the sip-ops list.

--
Dean

---

From: "Scott Lawrence" <[email-masked]>
Date: Fri, 01 May 2009 15:13:40 -0400

> Hadriel Kaplan wrote:
> > Depends on how you plan to disambiguate legal characters in the
> > fields from the field separators...

On Wed, 2009-04-29 at 16:45 -0500, Vijay K. Gurbani wrote:

> Right; this is a nagging problem at the back of my head ever
> since Dale pointed it out.  The least impacting way to deal
> with this, I believe, will be not to save display-name type
> of constructs but only addr-spec for URIs.  The generic-param
> construct is another potential problem.  Spaces in it need
> to be escaped or generic-param could be simply unallowed. 

> > But anyway, I think the real question that needs to be answered
> > *first* is "what is the purpose of the CLF?"  What is it going to
> > help admins do?  Is it for troubleshooting, or for registration audit
> > logging, or for IDS systems, etc?
> 
>  From the list above, at least for troubleshooting, logging, and
> IDS systems.  What I do not envision CLF being used for is
> debugging (distinct from troubleshooting) and CDR.

If you're going to include troubleshooting in the list of purposes, then
removing anything from the name-addr fields, or any generic-param is
going to be problematic.  I know you couldn't debug some configurations
on my system if you'd stripped some of the proprietary parameters we
use.