Subject: [dispatch] Next revision for the proposed CLF charter

From: Robert Sparks <[email-masked]>
Date: Fri, 31 Jul 2009 12:07:14 +0200

The SIP Common Log Format (CLF) working group is chartered to define
a standard logging format for systems processing SIP messages.

Well-known web servers such as Apache and web proxies like Squid
support event logging using a common log format.  The logs produced
using these de-facto standard formats are invaluable to system
administrators for trouble-shooting a server and tool writers to
craft tools that mine the log files to produce reports and trends
and to search for a certain message or messages, a transaction
or a related set of transactions.  Furthermore, these log records
can also be used to train anomaly detection systems and feed events
into a security event management system.

The Session Initiation Protocol does not have a common log
format. Diverse elements provide distinct log formats making
it complex to produce tools to analyze them.

The CLF working group will produce a format suitable for logging
from any SIP element. The format will anticipate the need to
search, merge, and summarize the log records from diverse elements.
The format will anticipate the need to correlate messages from
multiple elements related to a given request (that may fork) or a
given dialog. The format will take SIP's extensibility into
consideration, providing a way to represent SIP message components
that are defined in the future.  The format will anticipate being
used both for off-line analysis and on-line real-time processing
applications. The working group will consider the need for
efficient creation of records and the need for efficient processing
of the records.

The working group will identify the fields to appear in a log
record and provide one or more formats for encoding those fields.
The working group is not pre-constrained to producing either a
bit-field oriented or text-oriented format, and may choose to
provide both. If the group chooses to specify both, it must be
possible to mechanically translate between the formats without loss
of information.

Specifying the mechanics of exchanging, transporting, and storing
SIP Common Log Format records is explicitly out of scope. Specifying
a real-time transfer mechanism for heuristic analysis is explicitly
out of scope.

The group will generate:

- A problem statement enunciating the motivation,
and use cases for a SIP Common Log Format. This analysis
will identify the required minimal information that must
appear in any record.

- A specification of the SIP Common Log Format record

The group will consider providing one or more reference
implementations for decoding a CLF record.

Goals and Milestones
===========================

Oct 09 - Problem statement, motivation, and use cases
          WGLC
Nov 09 - Problem statement, motivation, and use cases
          to IESG (Informational)
Jan 10 - SIP Common Log Format specification
          WGLC
Feb 10 - SIP Common Log Format specification
          to IESG (PS)

---

From: Robert Sparks <[email-masked]>
Date: Fri, 31 Jul 2009 14:28:40 +0200

For those not in the ad-hoc - this was the text before the meeting we  
had today.

We got a lot of good feedback (minutes should be in soon). Expect a  
revision
of this in a few days (probably sometime week after next).

RjS

On Jul 31, 2009, at 12:07 PM, Robert Sparks wrote:

> _______________________________________________
> sip-clf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sip-clf

---

From: Atsushi Kobayashi <[email-masked]>
Date: Sat, 01 Aug 2009 13:15:39 +0900

Dear all,

I have one question.
Does this charter include the media description part, i.e. SDP?
I understood this motivation, however regarding security and trouble
shooting, we need to track signaling and media as well.
If SIP-CLF outputs the media description, we can correlate SIP signaling
and media traffic data. The media traffic data may be outputted by IPFIX
or other protocols.

Otherwise, is it future work?

Regards,
Atsushi

On Fri, 31 Jul 2009 12:07:14 +0200

> implementations for decoding a CLF record.

--- 
Atsushi KOBAYASHI  <[email-masked]>
NTT Information Sharing Platform Lab.
tel:+81-(0)422-59-3978 fax:+81-(0)422-59-5637