Subject: [dispatch] Room for DISPATCH ad-hoc on CLF : Room 300 over Lunch on Friday

From: Robert Sparks <[email-masked]>
Date: Mon, 27 Jul 2009 17:46:26 +0200

Room 300 over lunch on Friday

---

From: Gonzalo Camarillo <[email-masked]>
Date: Tue, 28 Jul 2009 09:44:36 +0200

Hi,

since we are now allowed to bring food into the building, we will run 
this meeting from 12:00 to 13:00 so that people can either have a quick 
lunch from 11:30 to 12:00 or grab some food somewhere and bring it to 
the meeting.

Cheers,

Gonzalo

Robert Sparks wrote:
> _______________________________________________
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch
>

---

From: "Spencer Dawkins" <[email-masked]>
Date: Tue, 28 Jul 2009 09:47:30 +0200

Just to provide some logistics:

We'll meet from 12 until 12:50 or so. Please use the 11:30-12:00 time to
grab lunch. .SE has made arrangements to allow us to bring food into the
conference center (not into the large conference rooms, but the rest of the
building is OK), so you can pick up lunch and munch while we chat.

Robert's goals for this session are:

- To discuss feedback we gotten so far,
- To refine the charter, and
- To organize the next steps of work

Please prepare for the meeting with these thoughts in mind.

I also note that Robert's milestone dates on the proposed charter are 
currently:

Oct 09 - Problem statement, motivation, and use cases WGLC
Nov 09 - Problem statement, motivation, and use cases to IESG 
(Informational)
Jan 10 - SIP Common Log Format specification WGLC
Feb 10 - SIP Common Log Format specification to IESG (PS)

There's not a lot of time between now and October/November, so please come 
prepared to make progress!

Thanks,

Spencer

---

From: "Spencer Dawkins" <[email-masked]>
Date: Thu, 30 Jul 2009 00:14:09 +0200

The SIP-CLF DISPATCH ad hoc on Friday is intended to form a working group,
and we'll be noodling over charter text that Robert has produced (in
consultation with others) during the meeting.

Just to make sure we're all on the same page, here's the charter text we'll
be discussing - please look it over BEFORE the meeting (and if you want to 
talk about it on the [email-masked] mailing list before the meeting, 
that's fine, too):

The SIP Common Log Format (CLF) working group is chartered to define a
standard logging format for systems processing SIP messages.

Well-known web servers such as Apache and web proxies like Squid support
event logging using a common log format. The logs produced using these
de-facto standard formats are invaluable to system administrators for
trouble-shooting a server and tool writers to craft tools that mine the log
files to produce reports and trends and to search for a certain SIP message
or messages, a transaction or a related set of transactions. Furthermore,
these log records can also be used to train anomaly detection systems and
feed events into a security event management system.

The Session Initiation Protocol does not have a common log format. Diverse
element provide distinct log formats making it complex to produce tools to
analyze them.

The CLF working group will produce a format suitable for logging from any
SIP element. The format will anticipate the need to search, merge, and
summarize the log records from diverse elements. The format will anticipate
the need to correlate messages from multiple elements related to a given
request (that may fork) or a given dialog. The format will take SIP's
extensibility into consideration, providing a way to represent SIP message
components that are defined in the future. The format will anticipate being
used both for off-line analysis and on-line real-time processing
applications. The working group will consider the need for efficient
creation of records and the need for efficient processing of the records.

The working group will identify the fields to appear in a log record and
provide one or more formats for encoding those fields. The working group is
not pre-constrained to producing either a bit-field oriented or
text-oriented format, and may choose to provide both. If the group chooses
to specify both, it must be possible to mechanically translate between the
formats without loss of information.

Specifying the mechanics of exchanging, transporting, and storing SIP
Common Log Format records is explicitly out of scope. Specifying a real-time
transfer mechanism for heuristic analysis is explicitly out of scope.

The group will generate:

A problem statement enunciating the motivation, and use cases for a SIP
Common Log Format. This analysis will identify the required minimal
information that must appear in any record.

A specification of the SIP Common Log Format record

The group will consider providing one or more reference implementations for
decoding a CLF record.

One more piece of logistics ...

We'll need at least one, and preferably two, scribes and a jabber scribe for
our CLF session on Friday during lunch.

We'll call for volunteers at the meeting if necessary - we can't have the
meeting without producing minutes - but it would be great if you could
consider volunteering NOW.

We have about an hour to get through some pretty important discussions, and
every minute we DON'T spend gazing meaningfully at the attendees (us) and
looking down at computers trying not to make eye contact with the chairs
(you) is a minute that we can use more productively!

Thanks,

Spencer and Theo

---

From: Tom Taylor <[email-masked]>
Date: Thu, 30 Jul 2009 09:03:19 +0200

Small comments below.

Spencer Dawkins wrote:
> be discussing - please look it over BEFORE the meeting (and if you want 
> to talk about it on the [email-masked] mailing list before the 
> meeting, that's fine, too):
> 

[PTT] Since this is a description of existing usage, I would drop "SIP" four 
lines up.
> element provide distinct log formats making it complex to produce tools to
[PTT] element -> elements
...

---

From: Vijay Gurbani <[email-masked]>
Date: Thu, 30 Jul 2009 02:50:14 -0500

> Small comments below.
[...]
> [PTT] Since this is a description of existing usage, I would drop "SIP" 
> four lines up.

Yes, I agree.  I was about to make the same comment as well.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
WWW:   http://ect.bell-labs.com/who/vkg

---

From: "Spencer Dawkins" <[email-masked]>
Date: Fri, 31 Jul 2009 10:56:22 +0200

Just to let people know - Mary has graciously posted the SIP-CLF slides to 
the meeting materials page (since this is a DISPATCH ad hoc, they're under 
DISPATCH).

URLs are

http://www.ietf.org/proceedings/75/slides/dispatch-6.ppt
http://www.ietf.org/proceedings/75/slides/dispatch-5.pdf

See you in about an hour...

Spencer

---

From: "Jan Seedorf" <[email-masked]>
Date: Fri, 31 Jul 2009 13:04:34 +0200

Dear Spencer,

Are the slides from the bof available? And who was the second chair of the bof?

 - Jan

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Spencer Dawkins
> Sent: Donnerstag, 30. Juli 2009 00:14
> To: dispatch mailing list
> Cc: [email-masked]
> Subject: Re: [dispatch] Room for DISPATCH ad-hoc on CLF : Room 300
> overLunchon Friday
> 
> to

---

From: "Mary Barnes" <[email-masked]>
Date: Fri, 31 Jul 2009 06:11:56 -0500

The charts are in the meeting materials for IETF-75 under the DISPATCH working group.  Theo was the second chair.

Mary. 

-----Original Message-----
From: [email-masked] on behalf of Jan Seedorf
Sent: Fri 7/31/2009 6:04 AM
To: Spencer Dawkins; dispatch mailing list
Subject: Re: [dispatch] Room for DISPATCH ad-hoc on CLF : Room 300overLunchon Friday
 
Dear Spencer,

 - Jan