From john.elwell@siemens-enterprise.com Wed May 4 03:37:56 2011 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2C3BE0727 for ; Wed, 4 May 2011 03:37:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.147 X-Spam-Level: X-Spam-Status: No, score=-105.147 tagged_above=-999 required=5 tests=[AWL=1.452, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ReEToNI+R5NL for ; Wed, 4 May 2011 03:37:55 -0700 (PDT) Received: from mail216.messagelabs.com (mail216.messagelabs.com [85.158.143.99]) by ietfa.amsl.com (Postfix) with SMTP id CB27BE0725 for ; Wed, 4 May 2011 03:37:51 -0700 (PDT) X-VirusChecked: Checked X-Env-Sender: john.elwell@siemens-enterprise.com X-Msg-Ref: server-13.tower-216.messagelabs.com!1304505470!3998417!1 X-StarScan-Version: 6.2.9; banners=-,-,- X-Originating-IP: [62.134.46.9] Received: (qmail 6166 invoked from network); 4 May 2011 10:37:50 -0000 Received: from unknown (HELO senmx11-mx) (62.134.46.9) by server-13.tower-216.messagelabs.com with SMTP; 4 May 2011 10:37:50 -0000 Received: from MCHP064A.global-ad.net (unknown [172.29.37.63]) by senmx11-mx (Server) with ESMTP id 5B16F1EB83D3; Wed, 4 May 2011 12:37:50 +0200 (CEST) Received: from MCHP058A.global-ad.net ([172.29.37.55]) by MCHP064A.global-ad.net ([172.29.37.63]) with mapi; Wed, 4 May 2011 12:37:50 +0200 From: "Elwell, John" To: Peter Musgrave , "sip-clf@ietf.org Mailing" Date: Wed, 4 May 2011 12:37:48 +0200 Thread-Topic: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt Thread-Index: Acv9/IOreUVRZrHnTQqksPPyvAtHjgMSEKbw Message-ID: References: <20110418143004.807.72505.idtracker@ietfc.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 May 2011 10:37:56 -0000 I wasn't able to do a complete review, but it looks in good shape. I notice= d the following: "From - The From URI. Whilst one may question the value of the From URI in light of RFC4744 [RFC4474], the From URI, nonetheless, imparts some information. For one, the From tag is important and, in the case of a REGISTER request, the From URI can provide information on whether this was a third-party registration or a first-party one. It is not necessary to log any URI parameters." In fact the From tag is not part of the From URI. The From tag is covered i= n the next bullet, so we should not mention it here. John > -----Original Message----- > From: sip-clf-bounces@ietf.org=20 > [mailto:sip-clf-bounces@ietf.org] On Behalf Of Peter Musgrave > Sent: 18 April 2011 20:12 > To: sip-clf@ietf.org Mailing > Subject: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt >=20 > Greetings CLF-ers,=20 >=20 > I would like to start a two week WGLC on the problem=20 > statement doc (in accordance with our discussion in Prague).=20 >=20 > Please make you comments on the list by Wed. May 4th (I have=20 > added a few days to account for the Easter break).=20 >=20 > We need reviewers and fresh eyes - so if you can make time to=20 > read this it is much appreciated! >=20 > Thanks,=20 >=20 > Peter Musgrave > Chair, sip-clf >=20 >=20 > Begin forwarded message: >=20 >=20 > From: Internet-Drafts@ietf.org > =09 > Date: April 18, 2011 10:30:04 AM EDT > =09 > To: i-d-announce@ietf.org > =09 > Cc: sip-clf@ietf.org > =09 > Subject: [sip-clf] I-D=20 > Action:draft-ietf-sipclf-problem-statement-06.txt > =09 >=20 > A New Internet-Draft is available from the on-line=20 > Internet-Drafts directories. > This draft is a work item of the SIP Common Log Format=20 > Working Group of the IETF. > =09 > =09 > Title : The Common Log Format (CLF) for the=20 > Session Initiation Protocol (SIP) > Author(s) : V. Gurbani, et al. > Filename : draft-ietf-sipclf-problem-statement-06.txt > Pages : 34 > Date : 2011-04-18 > =09 > Well-known web servers such as Apache and web proxies like Squid > support event logging using a common log format. The=20 > logs produced > using these de-facto standard formats are invaluable to system > administrators for trouble-shooting a server and tool writers to > craft tools that mine the log files and produce reports=20 > and trends. > Furthermore, these log files can also be used to train anomaly > detection systems and feed events into a security event=20 > management > system. The Session Initiation Protocol does not have=20 > a common log > format, and as a result, each server supports a=20 > distinct log format > that makes it unnecessarily complex to produce tools to do trend > analysis and security detection. We propose a common=20 > log file format > for SIP servers that can be used uniformly by proxies,=20 > registrars, > redirect servers as well as back-to-back user agents. > =09 > A URL for this Internet-Draft is: > =09 > http://www.ietf.org/internet-drafts/draft-ietf-sipclf-problem- > statement-06.txt > =09 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > =09 > Below is the data which will enable a MIME compliant mail reader > implementation to automatically retrieve the ASCII=20 > version of the > Internet-Draft. > =09 >=20 > = From peter.musgrave@magorcorp.com Wed May 4 06:39:48 2011 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EBE3E0762 for ; Wed, 4 May 2011 06:39:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.066 X-Spam-Level: X-Spam-Status: No, score=-103.066 tagged_above=-999 required=5 tests=[AWL=0.532, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tTOq8+nfUZWH for ; Wed, 4 May 2011 06:39:47 -0700 (PDT) Received: from mail-yw0-f44.google.com (mail-yw0-f44.google.com [209.85.213.44]) by ietfa.amsl.com (Postfix) with ESMTP id 0F8DAE0682 for ; Wed, 4 May 2011 06:39:46 -0700 (PDT) Received: by ywi6 with SMTP id 6so469366ywi.31 for ; Wed, 04 May 2011 06:39:46 -0700 (PDT) Received: by 10.151.69.24 with SMTP id w24mr1067555ybk.263.1304516385897; Wed, 04 May 2011 06:39:45 -0700 (PDT) Received: from petermac.magor.local ([72.1.217.106]) by mx.google.com with ESMTPS id u20sm507765yba.0.2011.05.04.06.39.44 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 04 May 2011 06:39:44 -0700 (PDT) Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: multipart/alternative; boundary=Apple-Mail-52--208331340 From: Peter Musgrave In-Reply-To: <8CB1F01A-91E7-4A02-A984-718AEC84EE0B@magorcorp.com> Date: Wed, 4 May 2011 09:39:43 -0400 Message-Id: <96B28772-470F-4010-A372-7432A43CBB0F@magorcorp.com> References: <20110418143004.807.72505.idtracker@ietfc.amsl.com> <8CB1F01A-91E7-4A02-A984-718AEC84EE0B@magorcorp.com> To: Peter Musgrave X-Mailer: Apple Mail (2.1084) Cc: "sip-clf@ietf.org Mailing" Subject: Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 May 2011 13:39:48 -0000 --Apple-Mail-52--208331340 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii As promised here my "as individual" review of the examples: In section 9.2: To: sip:bob@example.net R-URI: sip:bob@bob1.example.net I am trying to reconcile these. It is not stated in the start that bob = is registered to p2. I am assuming that p2 is authoritative for bob = (Hence the value in the To: header) ? Should the intro state that Bob is registered to p2? Went through the rest fairly carefully. All looks good.=20 Cheers,=20 Peter Musgrave On 2011-04-27, at 2:42 PM, Peter Musgrave wrote: > (as individual) >=20 > Overall, I think this is in excellent shape. I have a few specific = observations/questions: >=20 > Last sentence of abstract could be simplified just to SIP devices? (In = section 4 UA is explicitly mentioned - and it's not in the abstract = which has a list of SIP server type devices).=20 >=20 > 8.1 From/To Header > Both contain the statement "it is not necessary to log any URI = parameters".=20 > Perhaps this should be in normative language? URI parameters MUST NOT = be logged (they can be logged separately using an option field) >=20 > R-URI: URI parameters MUST be logged? >=20 > 8.2 Is it necessary to indicate what a UAS-half and UAC-half are? I = can see that for a proxy a request is both received and forwarded = (although I am not sure I would use the term UAC-half for the sent side = of a message.) As for a B2BUA I tend to think of the two sides as a UAC = and a UAS (and not a "half") >=20 > [I have set aside the examples for now - I will finish reviewing that = before the WGLC ends]. >=20 > Cheers,=20 >=20 > Peter >=20 >=20 >=20 >=20 >=20 > On 2011-04-18, at 3:11 PM, Peter Musgrave wrote: >=20 >> Greetings CLF-ers, >>=20 >> I would like to start a two week WGLC on the problem statement doc = (in accordance with our discussion in Prague).=20 >>=20 >> Please make you comments on the list by Wed. May 4th (I have added a = few days to account for the Easter break).=20 >>=20 >> We need reviewers and fresh eyes - so if you can make time to read = this it is much appreciated! >>=20 >> Thanks,=20 >>=20 >> Peter Musgrave >> Chair, sip-clf >>=20 >> Begin forwarded message: >>=20 >>> From: Internet-Drafts@ietf.org >>> Date: April 18, 2011 10:30:04 AM EDT >>> To: i-d-announce@ietf.org >>> Cc: sip-clf@ietf.org >>> Subject: [sip-clf] I-D = Action:draft-ietf-sipclf-problem-statement-06.txt >>>=20 >>> A New Internet-Draft is available from the on-line Internet-Drafts = directories. >>> This draft is a work item of the SIP Common Log Format Working Group = of the IETF. >>>=20 >>>=20 >>> Title : The Common Log Format (CLF) for the Session = Initiation Protocol (SIP) >>> Author(s) : V. Gurbani, et al. >>> Filename : draft-ietf-sipclf-problem-statement-06.txt >>> Pages : 34 >>> Date : 2011-04-18 >>>=20 >>> Well-known web servers such as Apache and web proxies like Squid >>> support event logging using a common log format. The logs produced >>> using these de-facto standard formats are invaluable to system >>> administrators for trouble-shooting a server and tool writers to >>> craft tools that mine the log files and produce reports and trends. >>> Furthermore, these log files can also be used to train anomaly >>> detection systems and feed events into a security event management >>> system. The Session Initiation Protocol does not have a common log >>> format, and as a result, each server supports a distinct log format >>> that makes it unnecessarily complex to produce tools to do trend >>> analysis and security detection. We propose a common log file = format >>> for SIP servers that can be used uniformly by proxies, registrars, >>> redirect servers as well as back-to-back user agents. >>>=20 >>> A URL for this Internet-Draft is: >>> = http://www.ietf.org/internet-drafts/draft-ietf-sipclf-problem-statement-06= .txt >>>=20 >>> Internet-Drafts are also available by anonymous FTP at: >>> ftp://ftp.ietf.org/internet-drafts/ >>>=20 >>> Below is the data which will enable a MIME compliant mail reader >>> implementation to automatically retrieve the ASCII version of the >>> Internet-Draft. >> >>> _______________________________________________ >>> sip-clf mailing list >>> sip-clf@ietf.org >>> https://www.ietf.org/mailman/listinfo/sip-clf >>=20 >=20 --Apple-Mail-52--208331340 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii

In section 9.2:
  =
      To: sip:bob@example.net
I = am trying to reconcile these. It is not stated in the start that bob is = registered to p2. I am assuming that p2 is authoritative for bob (Hence = the value in the To: header) ?
Should the intro state = that Bob is registered to p2?

Went through the rest = fairly carefully. All looks good. 

Cheers, 

Peter = Musgrave

On 2011-04-27, at 2:42 = PM, Peter Musgrave wrote:

(as = individual)

Overall, I think this is in = excellent shape. I have a few specific observations/questions:

Last sentence of abstract could = be simplified just to SIP devices? (In section 4 UA is explicitly = mentioned - and it's not in the abstract which has a list of SIP server = type devices). 

Both contain the statement "it is not necessary = to log any URI parameters". 
Perhaps this should be in = normative language? URI parameters MUST NOT be logged (they can be = logged separately using an option field)
R-URI: URI parameters MUST be logged?

8.2 Is it necessary to indicate = what a UAS-half and UAC-half are? I can see that for a proxy a request = is both received and forwarded (although I am not sure I would use the = term UAC-half for the sent side of a message.) As for a B2BUA I tend to = think of the two sides as a UAC and a UAS (and not a "half")

[I have set aside the examples = for now - I will finish reviewing that before the WGLC ends].
Cheers, 





Greetings = CLF-ers,

I would like to start a two week WGLC on the = problem statement doc (in accordance with our discussion in = Prague). 

Please make you comments on the = list by Wed. May 4th (I have added a few days to account for the Easter = break). 

We need reviewers and fresh eyes = - so if you can make time to read this it is much = appreciated!

Thanks, 

Peter Musgrave
Chair, sip-clf

Begin = forwarded message:

Date: April 18, 2011 10:30:04 AM EDT
Subject: [sip-clf] I-D = Action:draft-ietf-sipclf-problem-statement-06.txt

=
A New Internet-Draft is available from the on-line Internet-Drafts = directories.
This draft is a work item of the SIP Common Log Format = Working Group of the IETF.


Title =           : The Common = Log Format (CLF) for the Session Initiation Protocol (SIP)
Author(s) =       : V. Gurbani, et al.
Filename =        : = draft-ietf-sipclf-problem-statement-06.txt
Pages =           : = 34
= Date =            : = 2011-04-18

Well-known web servers such as Apache and web proxies = like Squid
support event logging using a common log format.  The = logs produced
using these de-facto standard formats are invaluable to = system
administrators for trouble-shooting a server and tool writers = to
craft tools that mine the log files and produce reports and = trends.
Furthermore, these log files can also be used to train = anomaly
detection systems and feed events into a security event = management
system.  The Session Initiation Protocol does not = have a common log
format, and as a result, each server supports a = distinct log format
that makes it unnecessarily complex to produce = tools to do trend
analysis and security detection.  We propose a = common log file format
for SIP servers that can be used uniformly by = proxies, registrars,
redirect servers as well as back-to-back user = agents.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-sipclf-proble= m-statement-06.txt

Internet-Drafts are also available by = anonymous FTP at:
ftp://ftp.ietf.org/internet-d= rafts/

Below is the data which will enable a MIME compliant = mail reader
implementation to automatically retrieve the ASCII = version of = the
Internet-Draft.
<M= ail Attachment>
_______________________________________________
sip-= clf mailing list
sip-clf@ietf.org
https://www.ietf.or= g/mailman/listinfo/sip-clf



= --Apple-Mail-52--208331340-- From peter.musgrave@magorcorp.com Tue May 10 08:41:22 2011 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E38F3E06D5 for ; Tue, 10 May 2011 08:41:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.199 X-Spam-Level: X-Spam-Status: No, score=-103.199 tagged_above=-999 required=5 tests=[AWL=0.400, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OVNf9WRr9x-d for ; Tue, 10 May 2011 08:41:22 -0700 (PDT) Received: from mail-yw0-f44.google.com (mail-yw0-f44.google.com [209.85.213.44]) by ietfa.amsl.com (Postfix) with ESMTP id DF30EE06CC for ; Tue, 10 May 2011 08:41:21 -0700 (PDT) Received: by ywi6 with SMTP id 6so2755694ywi.31 for ; Tue, 10 May 2011 08:41:21 -0700 (PDT) Received: by 10.151.132.19 with SMTP id j19mr7327420ybn.272.1305042080082; Tue, 10 May 2011 08:41:20 -0700 (PDT) Received: from petermac.magor.local ([72.1.217.106]) by mx.google.com with ESMTPS id s16sm5216121anj.26.2011.05.10.08.41.18 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 10 May 2011 08:41:18 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1084) From: Peter Musgrave In-Reply-To: Date: Tue, 10 May 2011 11:41:17 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <20110418143004.807.72505.idtracker@ietfc.amsl.com> To: "sip-clf@ietf.org Mailing" X-Mailer: Apple Mail (2.1084) Subject: Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 May 2011 15:41:23 -0000 I will extend the WGLC until Friday May 13th.=20 If you can find to time to look at the doc - or even just the diffs and = indicate you have done so, it would be appreciated.=20 Regards,=20 Peter Musgrave Chair, SIP-CLF Please try and=20 On 2011-05-04, at 6:37 AM, Elwell, John wrote: >=20 >> -----Original Message----- >> From: sip-clf-bounces@ietf.org=20 >> [mailto:sip-clf-bounces@ietf.org] On Behalf Of Peter Musgrave >> Sent: 18 April 2011 20:12 >> To: sip-clf@ietf.org Mailing >> Subject: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt >>=20 >> Greetings CLF-ers,=20 >>=20 >> I would like to start a two week WGLC on the problem=20 >> statement doc (in accordance with our discussion in Prague).=20 >>=20 >> Please make you comments on the list by Wed. May 4th (I have=20 >> added a few days to account for the Easter break).=20 >>=20 >> We need reviewers and fresh eyes - so if you can make time to=20 >> read this it is much appreciated! >>=20 >> Thanks,=20 >>=20 >> Peter Musgrave >> Chair, sip-clf >>=20 >>=20 >> Begin forwarded message: >>=20 >>=20 >> From: Internet-Drafts@ietf.org >> =09 >> Date: April 18, 2011 10:30:04 AM EDT >> =09 >> To: i-d-announce@ietf.org >> =09 >> Cc: sip-clf@ietf.org >> =09 >> Subject: [sip-clf] I-D=20 >> Action:draft-ietf-sipclf-problem-statement-06.txt >> =09 >>=20 >> A New Internet-Draft is available from the on-line=20 >> Internet-Drafts directories. >> This draft is a work item of the SIP Common Log Format=20 >> Working Group of the IETF. >> =09 >> =09 >> Title : The Common Log Format (CLF) for the=20 >> Session Initiation Protocol (SIP) >> Author(s) : V. Gurbani, et al. >> Filename : draft-ietf-sipclf-problem-statement-06.txt >> Pages : 34 >> Date : 2011-04-18 >> =09 >> Well-known web servers such as Apache and web proxies like Squid >> support event logging using a common log format. The=20 >> logs produced >> using these de-facto standard formats are invaluable to system >> administrators for trouble-shooting a server and tool writers to >> craft tools that mine the log files and produce reports=20 >> and trends. >> Furthermore, these log files can also be used to train anomaly >> detection systems and feed events into a security event=20 >> management >> system. The Session Initiation Protocol does not have=20 >> a common log >> format, and as a result, each server supports a=20 >> distinct log format >> that makes it unnecessarily complex to produce tools to do trend >> analysis and security detection. We propose a common=20 >> log file format >> for SIP servers that can be used uniformly by proxies,=20 >> registrars, >> redirect servers as well as back-to-back user agents. >> =09 >> A URL for this Internet-Draft is: >> =09 >> http://www.ietf.org/internet-drafts/draft-ietf-sipclf-problem- >> statement-06.txt >> =09 >> Internet-Drafts are also available by anonymous FTP at: >> ftp://ftp.ietf.org/internet-drafts/ >> =09 >> Below is the data which will enable a MIME compliant mail reader >> implementation to automatically retrieve the ASCII=20 >> version of the >> Internet-Draft. >> =09 >>=20 >>=20 From gsalguei@cisco.com Tue May 10 11:25:32 2011 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71C33E07F4 for ; Tue, 10 May 2011 11:25:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.598 X-Spam-Level: X-Spam-Status: No, score=-10.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Um38e3zktstq for ; Tue, 10 May 2011 11:25:31 -0700 (PDT) Received: from av-tac-rtp.cisco.com (hen.cisco.com [64.102.19.198]) by ietfa.amsl.com (Postfix) with ESMTP id 038B2E07D8 for ; Tue, 10 May 2011 11:25:30 -0700 (PDT) X-TACSUNS: Virus Scanned Received: from rooster.cisco.com (localhost.cisco.com [127.0.0.1]) by av-tac-rtp.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id p4AIPU64017220; Tue, 10 May 2011 14:25:30 -0400 (EDT) Received: from dhcp-64-102-155-106.cisco.com (dhcp-64-102-155-106.cisco.com [64.102.155.106]) by rooster.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id p4AIPUU2006108; Tue, 10 May 2011 14:25:30 -0400 (EDT) Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: multipart/alternative; boundary=Apple-Mail-26-327215398 From: Gonzalo Salgueiro In-Reply-To: Date: Tue, 10 May 2011 14:25:29 -0400 Message-Id: <677CC746-B604-4603-A87B-2B98C2AD85E4@cisco.com> References: <20110418143004.807.72505.idtracker@ietfc.amsl.com> To: Peter Musgrave X-Mailer: Apple Mail (2.1084) Cc: "sip-clf@ietf.org Mailing" Subject: Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 May 2011 18:25:32 -0000 --Apple-Mail-26-327215398 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Peter -=20 The document is ready IMO. My feedback and input to Vijay has been has = been provided adhoc along the way and is reflected in the current draft. Regards, Gonzalo =20 On May 10, 2011, at 11:41 AM, Peter Musgrave wrote: > I will extend the WGLC until Friday May 13th.=20 >=20 > If you can find to time to look at the doc - or even just the diffs = and indicate you have done so, it would be appreciated.=20 >=20 > Regards,=20 >=20 > Peter Musgrave > Chair, SIP-CLF >=20 > Please try and=20 > On 2011-05-04, at 6:37 AM, Elwell, John wrote: >=20 >>=20 >>> -----Original Message----- >>> From: sip-clf-bounces@ietf.org=20 >>> [mailto:sip-clf-bounces@ietf.org] On Behalf Of Peter Musgrave >>> Sent: 18 April 2011 20:12 >>> To: sip-clf@ietf.org Mailing >>> Subject: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt >>>=20 >>> Greetings CLF-ers,=20 >>>=20 >>> I would like to start a two week WGLC on the problem=20 >>> statement doc (in accordance with our discussion in Prague).=20 >>>=20 >>> Please make you comments on the list by Wed. May 4th (I have=20 >>> added a few days to account for the Easter break).=20 >>>=20 >>> We need reviewers and fresh eyes - so if you can make time to=20 >>> read this it is much appreciated! >>>=20 >>> Thanks,=20 >>>=20 >>> Peter Musgrave >>> Chair, sip-clf >>>=20 >>>=20 >>> Begin forwarded message: >>>=20 >>>=20 >>> From: Internet-Drafts@ietf.org >>> =09 >>> Date: April 18, 2011 10:30:04 AM EDT >>> =09 >>> To: i-d-announce@ietf.org >>> =09 >>> Cc: sip-clf@ietf.org >>> =09 >>> Subject: [sip-clf] I-D=20 >>> Action:draft-ietf-sipclf-problem-statement-06.txt >>> =09 >>>=20 >>> A New Internet-Draft is available from the on-line=20 >>> Internet-Drafts directories. >>> This draft is a work item of the SIP Common Log Format=20 >>> Working Group of the IETF. >>> =09 >>> =09 >>> Title : The Common Log Format (CLF) for the=20 >>> Session Initiation Protocol (SIP) >>> Author(s) : V. Gurbani, et al. >>> Filename : draft-ietf-sipclf-problem-statement-06.txt >>> Pages : 34 >>> Date : 2011-04-18 >>> =09 >>> Well-known web servers such as Apache and web proxies like Squid >>> support event logging using a common log format. The=20 >>> logs produced >>> using these de-facto standard formats are invaluable to system >>> administrators for trouble-shooting a server and tool writers to >>> craft tools that mine the log files and produce reports=20 >>> and trends. >>> Furthermore, these log files can also be used to train anomaly >>> detection systems and feed events into a security event=20 >>> management >>> system. The Session Initiation Protocol does not have=20 >>> a common log >>> format, and as a result, each server supports a=20 >>> distinct log format >>> that makes it unnecessarily complex to produce tools to do trend >>> analysis and security detection. We propose a common=20 >>> log file format >>> for SIP servers that can be used uniformly by proxies,=20 >>> registrars, >>> redirect servers as well as back-to-back user agents. >>> =09 >>> A URL for this Internet-Draft is: >>> =09 >>> http://www.ietf.org/internet-drafts/draft-ietf-sipclf-problem- >>> statement-06.txt >>> =09 >>> Internet-Drafts are also available by anonymous FTP at: >>> ftp://ftp.ietf.org/internet-drafts/ >>> =09 >>> Below is the data which will enable a MIME compliant mail reader >>> implementation to automatically retrieve the ASCII=20 >>> version of the >>> Internet-Draft. >>> =09 >>>=20 >>>=20 >=20 > _______________________________________________ > sip-clf mailing list > sip-clf@ietf.org > https://www.ietf.org/mailman/listinfo/sip-clf --Apple-Mail-26-327215398 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Peter = - 

The document is ready IMO. My feedback and = input to Vijay has been has been provided adhoc along the way and is = reflected in the current = draft.

Regards,

Gonzalo<= /div>

 
On May 10, 2011, at 11:41 = AM, Peter Musgrave wrote:

I = will extend the WGLC until Friday May 13th.

If you can find to = time to look at the doc - or even just the diffs and indicate you have = done so, it would be appreciated.

Regards,

Peter = Musgrave
Chair, SIP-CLF

Please try and
On 2011-05-04, at = 6:37 AM, Elwell, John wrote:


-----Original = Message-----
From: sip-clf-bounces@ietf.org =
[mailto:sip-clf-bounces@ietf.org] On Behalf Of Peter = Musgrave
Sent: 18 April 2011 = 20:12
To: sip-clf@ietf.org= Mailing
Subject: [sip-clf] = WGLC:draft-ietf-sipclf-problem-statement-06.txt

Greetings CLF-ers, =

I would like to start a two week = WGLC on the problem
statement doc (in accordance = with our discussion in Prague). =

Please make you comments on the = list by Wed. May 4th (I have
added a few days to account for = the Easter break).

We need reviewers and fresh eyes = - so if you can make time to
read this it is much = appreciated!

Thanks, =

Peter = Musgrave
Chair, = sip-clf


Begin forwarded = message:


From: Internet-Drafts@ietf.org
<= /blockquote>
=
= Date: April 18, 2011 10:30:04 AM = EDT
=
= To: i-d-announce@ietf.org
=
= Cc: sip-clf@ietf.org
=
= Subject: [sip-clf] I-D
Action:draft-ietf-sipclf-problem-statement-06.txt
=

A New Internet-Draft is available = from the on-line
Internet-Drafts = directories.
This draft is a work item of the = SIP Common Log Format
Working Group of the = IETF.
=
=
= Title =           : The Common = Log Format (CLF) for the
Session Initiation Protocol = (SIP)
= Author(s)       : V. Gurbani, et = al.
= Filename        : = draft-ietf-sipclf-problem-statement-06.txt
Pages =           : = 34
= Date =            : = 2011-04-18
=
= Well-known web servers such as Apache and web proxies like = Squid
= support event logging using a common log format.  The =
logs produced
using these de-facto standard = formats are invaluable to = system
= administrators for trouble-shooting a server and tool writers = to
= craft tools that mine the log files and produce reports =
and trends.
Furthermore, these log files can = also be used to train anomaly
detection systems and feed events = into a security event
management
system.  The Session = Initiation Protocol does not have =
a common log
format, and as a result, each = server supports a
distinct log = format
= that makes it unnecessarily complex to produce tools to do = trend
= analysis and security detection.  We propose a common =
log file format
for SIP servers that can be used = uniformly by proxies,
registrars,
redirect servers as well as = back-to-back user agents.
=
= A URL for this Internet-Draft = is:
=
ht= tp://www.ietf.org/internet-drafts/draft-ietf-sipclf-problem-
statement-06.txt
=
= Internet-Drafts are also available by anonymous FTP = at:
= ftp://ftp.ietf.org/internet-d= rafts/
=
= Below is the data which will enable a MIME compliant mail = reader
= implementation to automatically retrieve the ASCII =
version of the
= Internet-Draft.
=



__________________________= _____________________
sip-clf mailing list
sip-clf@ietf.org
https://www.ietf.= org/mailman/listinfo/sip-clf

= = --Apple-Mail-26-327215398--