From iesg-secretary@ietf.org Mon Dec 3 12:11:31 2012 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78EE121F885A; Mon, 3 Dec 2012 12:11:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.451 X-Spam-Level: X-Spam-Status: No, score=-102.451 tagged_above=-999 required=5 tests=[AWL=0.148, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KlnwKgwP1juG; Mon, 3 Dec 2012 12:11:30 -0800 (PST) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C2B1321F8647; Mon, 3 Dec 2012 12:11:30 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: IETF-Announce X-Test-IDTracker: no X-IETF-IDTracker: 4.36 Message-ID: <20121203201130.1496.92352.idtracker@ietfa.amsl.com> Date: Mon, 03 Dec 2012 12:11:30 -0800 Cc: sip-clf@ietf.org Subject: [sip-clf] Last Call: (Format for the Session Initiation Protocol (SIP) Common Log Format (CLF)) to Proposed Standard X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: ietf@ietf.org List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Dec 2012 20:11:31 -0000 The IESG has received a request from the SIP Common Log Format WG (sipclf) to consider the following document: - 'Format for the Session Initiation Protocol (SIP) Common Log Format (CLF)' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2012-12-17. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract The SIPCLF Workgroup has defined a common log format framework for Session Initiation Protocol (SIP) servers. This common log format mimics the successful event logging format found in well-known web servers like Apache and web proxies like Squid. This document proposes an indexed text encoding format for the SIP Common Log Format (CLF) that retains the key advantages of a text-based format, while significantly increasing processing performance over a purely text-based implementation. This file format adheres to the SIP CLF data model and provides an effective encoding scheme for all mandatory and optional fields that appear in a SIP CLF record. The file can be obtained via http://datatracker.ietf.org/doc/draft-ietf-sipclf-format/ IESG discussion can be tracked via http://datatracker.ietf.org/doc/draft-ietf-sipclf-format/ballot/ No IPR declarations have been submitted directly on this I-D. From iesg-secretary@ietf.org Mon Dec 3 12:45:20 2012 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3095421F8890; Mon, 3 Dec 2012 12:45:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.462 X-Spam-Level: X-Spam-Status: No, score=-102.462 tagged_above=-999 required=5 tests=[AWL=0.137, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qiz1nEx1PpNz; Mon, 3 Dec 2012 12:45:07 -0800 (PST) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EDCA21F880B; Mon, 3 Dec 2012 12:45:01 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: IETF-Announce X-Test-IDTracker: no X-IETF-IDTracker: 4.36 Message-ID: <20121203204501.12217.39525.idtracker@ietfa.amsl.com> Date: Mon, 03 Dec 2012 12:45:01 -0800 Cc: sip-clf@ietf.org Subject: [sip-clf] Last Call: (The Common Log Format (CLF) for the Session Initiation Protocol (SIP): Framework and Data Model) to Proposed Standard X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: ietf@ietf.org List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Dec 2012 20:45:20 -0000 The IESG has received a request from the SIP Common Log Format WG (sipclf) to consider the following document: - 'The Common Log Format (CLF) for the Session Initiation Protocol (SIP): Framework and Data Model' as Proposed Standard A previous version of this document was Last Called with an Informational intended publication status. Issues with the document's scope and technical concerns with internationalization were identified during IESG evaluation and the document was returned to the working group. The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2012-12-17. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract Well-known web servers such as Apache and web proxies like Squid support event logging using a common log format. The logs produced using these de-facto standard formats are invaluable to system administrators for trouble-shooting a server and tool writers to craft tools that mine the log files and produce reports and trends. Furthermore, these log files can also be used to train anomaly detection systems and feed events into a security event management system. The Session Initiation Protocol (SIP) does not have a common log format, and as a result, each server supports a distinct log format that makes it unnecessarily complex to produce tools to do trend analysis and security detection. We propose a common log file format for SIP servers that can be used uniformly by user agents, proxies, registrars, redirect servers as well as back-to-back user agents. The file can be obtained via http://datatracker.ietf.org/doc/draft-ietf-sipclf-problem-statement/ IESG discussion can be tracked via http://datatracker.ietf.org/doc/draft-ietf-sipclf-problem-statement/ballot/ No IPR declarations have been submitted directly on this I-D. From dromasca@avaya.com Mon Dec 17 08:02:51 2012 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38BED21F8B37; Mon, 17 Dec 2012 08:02:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.381 X-Spam-Level: X-Spam-Status: No, score=-103.381 tagged_above=-999 required=5 tests=[AWL=0.218, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9MCqFlmTBnwf; Mon, 17 Dec 2012 08:02:50 -0800 (PST) Received: from de307622-de-outbound.net.avaya.com (de307622-de-outbound.net.avaya.com [198.152.71.100]) by ietfa.amsl.com (Postfix) with ESMTP id D706621F8B39; Mon, 17 Dec 2012 08:02:49 -0800 (PST) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AgEKAKUvoFDGmAcF/2dsb2JhbABEgmzAaYEBB4IeAQEBAQMBAQEPKDQLDAQCAQgNBAQBAQsUBQQHJwsUCQgCBA4FCBqHaAEKniacAIwVhWlhA5cYhHGKNoJvghk X-IronPort-AV: E=Sophos;i="4.80,759,1344225600"; d="scan'208";a="336707118" Received: from unknown (HELO co300216-co-erhwest.avaya.com) ([198.152.7.5]) by de307622-de-outbound.net.avaya.com with ESMTP; 17 Dec 2012 10:56:03 -0500 Received: from unknown (HELO AZ-FFEXHC01.global.avaya.com) ([135.64.58.11]) by co300216-co-erhwest-out.avaya.com with ESMTP; 17 Dec 2012 10:59:37 -0500 Received: from AZ-FFEXMB04.global.avaya.com ([fe80::6db7:b0af:8480:c126]) by AZ-FFEXHC01.global.avaya.com ([135.64.58.11]) with mapi id 14.02.0318.004; Mon, 17 Dec 2012 11:02:40 -0500 From: "Romascanu, Dan (Dan)" To: "ietf@ietf.org" Thread-Topic: [sip-clf] Last Call: (The Common Log Format (CLF) for the Session Initiation Protocol (SIP): Framework and Data Model) to Proposed Standard Thread-Index: AQHN0Zcqqd06/SGCyUe0bHqFyrUH+ZgdOdKw Date: Mon, 17 Dec 2012 16:02:40 +0000 Message-ID: <9904FB1B0159DA42B0B887B7FA8119CA042028@AZ-FFEXMB04.global.avaya.com> References: <20121203204501.12217.39525.idtracker@ietfa.amsl.com> In-Reply-To: <20121203204501.12217.39525.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.64.58.46] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "sip-clf@ietf.org" Subject: Re: [sip-clf] Last Call: (The Common Log Format (CLF) for the Session Initiation Protocol (SIP): Framework and Data Model) to Proposed Standard X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Dec 2012 16:02:51 -0000 Hi, I believe that this is a good document and I support its approval.=20 I do have a number of issues which I suggest to take into consideration bef= ore approval and publication:=20 1. In Section 4:=20 The SIP CLF is amenable to easy parsing and lends itself well to creating other innovative tools. I am not sure what this sentence really says. What does 'easy parsing' mean= ? The previous paragraph referred to 'quick parsing (i.e., well-delimited f= ields)' - quick parsing is a relative notion but at least there was an exam= ple. Here, I do not know. What does 'other innovative tools' means escapes me totally. Why 'other'? '= other' than what? And what 'innovative tools' means?=20 2. In Section 11 SIP CLF log files will take up substantive amount of disk space depending on traffic volume at a processing entity and the amount of information being logged. As such, any organization using SIP CLF should establish operational procedures for file rollovers as appropriate to the needs of the organization. Procedures for file rollovers is not enough - actually there need to be in = place procedures for periodic retrieval of logs before rollover.=20 3. [RFC3261] needs to be a Normative Reference. All this document speaks ab= out logs for SIP, refers to SIP entities, messages, fields in the SIP messa= ges - on short it cannot be understood and the SIP-CLF cannot be implemente= d without a good reading and understanding of [RFC3261].=20 Regards, Dan =20 > -----Original Message----- > From: sip-clf-bounces@ietf.org [mailto:sip-clf-bounces@ietf.org] On > Behalf Of The IESG > Sent: Monday, December 03, 2012 10:45 PM > To: IETF-Announce > Cc: sip-clf@ietf.org > Subject: [sip-clf] Last Call: 11.txt> (The Common Log Format (CLF) for the Session Initiation Protocol > (SIP): Framework and Data Model) to Proposed Standard >=20 >=20 > The IESG has received a request from the SIP Common Log Format WG > (sipclf) to consider the following document: > - 'The Common Log Format (CLF) for the Session Initiation Protocol > (SIP): > Framework and Data Model' > as Proposed Standard >=20 > A previous version of this document was Last Called with an > Informational intended publication status. Issues with the document's > scope and technical concerns with internationalization were identified > during IESG evaluation and the document was returned to the working > group. >=20 > The IESG plans to make a decision in the next few weeks, and solicits > final comments on this action. Please send substantive comments to the > ietf@ietf.org mailing lists by 2012-12-17. Exceptionally, comments may > be sent to iesg@ietf.org instead. In either case, please retain the > beginning of the Subject line to allow automated sorting. >=20 > Abstract >=20 >=20 > Well-known web servers such as Apache and web proxies like Squid > support event logging using a common log format. The logs produced > using these de-facto standard formats are invaluable to system > administrators for trouble-shooting a server and tool writers to > craft tools that mine the log files and produce reports and trends. > Furthermore, these log files can also be used to train anomaly > detection systems and feed events into a security event management > system. The Session Initiation Protocol (SIP) does not have a common > log format, and as a result, each server supports a distinct log > format that makes it unnecessarily complex to produce tools to do > trend analysis and security detection. We propose a common log file > format for SIP servers that can be used uniformly by user agents, > proxies, registrars, redirect servers as well as back-to-back user > agents. >=20 >=20 >=20 >=20 > The file can be obtained via > http://datatracker.ietf.org/doc/draft-ietf-sipclf-problem-statement/ >=20 > IESG discussion can be tracked via > http://datatracker.ietf.org/doc/draft-ietf-sipclf-problem- > statement/ballot/ >=20 >=20 > No IPR declarations have been submitted directly on this I-D. >=20 >=20 > _______________________________________________ > sip-clf mailing list > sip-clf@ietf.org > https://www.ietf.org/mailman/listinfo/sip-clf From internet-drafts@ietf.org Thu Dec 20 23:53:45 2012 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B904021F84F9; Thu, 20 Dec 2012 23:53:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.526 X-Spam-Level: X-Spam-Status: No, score=-102.526 tagged_above=-999 required=5 tests=[AWL=0.073, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8t8Cgm52dhU0; Thu, 20 Dec 2012 23:53:45 -0800 (PST) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3453F21F847B; Thu, 20 Dec 2012 23:53:45 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.37 Message-ID: <20121221075345.25193.46606.idtracker@ietfa.amsl.com> Date: Thu, 20 Dec 2012 23:53:45 -0800 Cc: sip-clf@ietf.org Subject: [sip-clf] I-D Action: draft-ietf-sipclf-format-10.txt X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Dec 2012 07:53:45 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the SIP Common Log Format Working Group of th= e IETF. Title : Format for the Session Initiation Protocol (SIP) Common = Log Format (CLF) Author(s) : Gonzalo Salgueiro Vijay Gurbani Adam Roach Filename : draft-ietf-sipclf-format-10.txt Pages : 30 Date : 2012-12-20 Abstract: The SIPCLF Workgroup has defined a common log format framework for Session Initiation Protocol (SIP) servers. This common log format mimics the successful event logging format found in well-known web servers like Apache and web proxies like Squid. This document proposes an indexed text encoding format for the SIP Common Log Format (CLF) that retains the key advantages of a text-based format, while significantly increasing processing performance over a purely text-based implementation. This file format adheres to the SIP CLF information model and provides an effective encoding scheme for all mandatory and optional fields that appear in a SIP CLF record. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sipclf-format There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-sipclf-format-10 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sipclf-format-10 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From internet-drafts@ietf.org Fri Dec 21 08:51:22 2012 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AFD021F8891; Fri, 21 Dec 2012 08:51:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.526 X-Spam-Level: X-Spam-Status: No, score=-102.526 tagged_above=-999 required=5 tests=[AWL=0.073, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 56got1EKvIOr; Fri, 21 Dec 2012 08:51:22 -0800 (PST) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F1E0021F88B0; Fri, 21 Dec 2012 08:51:21 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.37 Message-ID: <20121221165121.19942.77689.idtracker@ietfa.amsl.com> Date: Fri, 21 Dec 2012 08:51:21 -0800 Cc: sip-clf@ietf.org Subject: [sip-clf] I-D Action: draft-ietf-sipclf-format-11.txt X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Dec 2012 16:51:22 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the SIP Common Log Format Working Group of th= e IETF. Title : Format for the Session Initiation Protocol (SIP) Common = Log Format (CLF) Author(s) : Gonzalo Salgueiro Vijay Gurbani Adam Roach Filename : draft-ietf-sipclf-format-11.txt Pages : 30 Date : 2012-12-21 Abstract: The SIPCLF Workgroup has defined a common log format framework for Session Initiation Protocol (SIP) servers. This common log format mimics the successful event logging format found in well-known web servers like Apache and web proxies like Squid. This document proposes an indexed text encoding format for the SIP Common Log Format (CLF) that retains the key advantages of a text-based format, while significantly increasing processing performance over a purely text-based implementation. This file format adheres to the SIP CLF information model and provides an effective encoding scheme for all mandatory and optional fields that appear in a SIP CLF record. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sipclf-format There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-sipclf-format-11 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sipclf-format-11 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From vkg@bell-labs.com Mon Dec 24 11:03:08 2012 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 972CD21F85CE; Mon, 24 Dec 2012 11:03:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -109.141 X-Spam-Level: X-Spam-Status: No, score=-109.141 tagged_above=-999 required=5 tests=[AWL=1.458, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E0OVoaeOiV6s; Mon, 24 Dec 2012 11:03:07 -0800 (PST) Received: from ihemail2.lucent.com (ihemail2.lucent.com [135.245.0.35]) by ietfa.amsl.com (Postfix) with ESMTP id AED7521F8599; Mon, 24 Dec 2012 11:03:07 -0800 (PST) Received: from usnavsmail4.ndc.alcatel-lucent.com (usnavsmail4.ndc.alcatel-lucent.com [135.3.39.12]) by ihemail2.lucent.com (8.13.8/IER-o) with ESMTP id qBOJ33RA016878 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Mon, 24 Dec 2012 13:03:04 -0600 (CST) Received: from umail.lucent.com (umail-ce2.ndc.lucent.com [135.3.40.63]) by usnavsmail4.ndc.alcatel-lucent.com (8.14.3/8.14.3/GMO) with ESMTP id qBOJ336a031581 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 24 Dec 2012 13:03:03 -0600 Received: from shoonya.ih.lucent.com (shoonya.ih.lucent.com [135.185.237.229]) by umail.lucent.com (8.13.8/TPES) with ESMTP id qBOJ32Q8015232; Mon, 24 Dec 2012 13:03:03 -0600 (CST) Message-ID: <50D8A750.2020005@bell-labs.com> Date: Mon, 24 Dec 2012 13:04:48 -0600 From: "Vijay K. Gurbani" Organization: Bell Laboratories, Alcatel-Lucent User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: "Romascanu, Dan (Dan)" References: <20121203204501.12217.39525.idtracker@ietfa.amsl.com> <9904FB1B0159DA42B0B887B7FA8119CA042028@AZ-FFEXMB04.global.avaya.com> In-Reply-To: <9904FB1B0159DA42B0B887B7FA8119CA042028@AZ-FFEXMB04.global.avaya.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.57 on 135.245.2.35 X-Scanned-By: MIMEDefang 2.64 on 135.3.39.12 Cc: "sip-clf@ietf.org" , "ietf@ietf.org" Subject: Re: [sip-clf] Last Call: (The Common Log Format (CLF) for the Session Initiation Protocol (SIP): Framework and Data Model) to Proposed Standard X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Dec 2012 19:03:08 -0000 Dan: Thank you for your review of the SIP CLF problem statement draft. I appreciate your time and resulting comments. Please see inline on resolution of your comments. I will be releasing an updated version of the draft shortly with the resolutions contained herein. On 12/17/2012 10:02 AM, Romascanu, Dan (Dan) wrote: > Hi, > > I believe that this is a good document and I support its approval. > > I do have a number of issues which I suggest to take into consideration before approval and publication: > > 1. In Section 4: > > The SIP CLF is amenable to easy parsing and lends itself well to > creating other innovative tools. > > I am not sure what this sentence really says. What does 'easy parsing' mean? The previous paragraph referred to 'quick parsing (i.e., well-delimited fields)' - quick parsing is a relative notion but at least there was an example. Here, I do not know. > > What does 'other innovative tools' means escapes me totally. Why 'other'? 'other' than what? And what 'innovative tools' means? I have changed the text to address your comment. The change is as follows: OLD: The SIP CLF is amenable to easy parsing and lends itself well to creating other innovative tools. NEW: Due to the structure imposed by delimited fields, the SIP CLF is amenable to easy parsing and lends itself well to creating other innovative tools such as logfile parsers and trend analytic engines. > 2. In Section 11 > > SIP CLF log files will take up substantive amount of disk space > depending on traffic volume at a processing entity and the amount of > information being logged. As such, any organization using SIP CLF > should establish operational procedures for file rollovers as > appropriate to the needs of the organization. > > Procedures for file rollovers is not enough - actually there need to be in place procedures for periodic retrieval of logs before rollover. Added the phrase "periodic retrieval of logs before rollover" in S11. > 3. [RFC3261] needs to be a Normative Reference. All this document speaks about logs for SIP, refers to SIP entities, messages, fields in the SIP messages - on short it cannot be understood and the SIP-CLF cannot be implemented without a good reading and understanding of [RFC3261]. I think it is a reasonable position that understanding rfc3261 is a pre- requsite for implementing SIP CLF. I have made rfc3261 normative as you suggest. Once again, thank you for your time and review of this work. - vijay -- Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent 1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60563 (USA) Email: vkg@{bell-labs.com,acm.org} / vijay.gurbani@alcatel-lucent.com Web: http://ect.bell-labs.com/who/vkg/ From internet-drafts@ietf.org Mon Dec 24 11:26:29 2012 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D06821F87E0; Mon, 24 Dec 2012 11:26:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.522 X-Spam-Level: X-Spam-Status: No, score=-102.522 tagged_above=-999 required=5 tests=[AWL=0.077, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m63kyWEa++18; Mon, 24 Dec 2012 11:26:28 -0800 (PST) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E07C21F882C; Mon, 24 Dec 2012 11:26:28 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.37 Message-ID: <20121224192628.2643.72666.idtracker@ietfa.amsl.com> Date: Mon, 24 Dec 2012 11:26:28 -0800 Cc: sip-clf@ietf.org Subject: [sip-clf] I-D Action: draft-ietf-sipclf-problem-statement-12.txt X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Dec 2012 19:26:29 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the SIP Common Log Format Working Group of th= e IETF. Title : The Common Log Format (CLF) for the Session Initiation P= rotocol (SIP): Framework and Information Model Author(s) : Vijay K. Gurbani Eric W. Burger Tricha Anjali Humberto Abdelnur Olivier Festor Filename : draft-ietf-sipclf-problem-statement-12.txt Pages : 37 Date : 2012-12-24 Abstract: Well-known web servers such as Apache and web proxies like Squid support event logging using a common log format. The logs produced using these de-facto standard formats are invaluable to system administrators for trouble-shooting a server and tool writers to craft tools that mine the log files and produce reports and trends. Furthermore, these log files can also be used to train anomaly detection systems and feed events into a security event management system. The Session Initiation Protocol (SIP) does not have a common log format, and as a result, each server supports a distinct log format that makes it unnecessarily complex to produce tools to do trend analysis and security detection. This document describes a framework, including requirements and analysis of existing approaches, and specifies an information model for development of a SIP common log file format that can be used uniformly by user agents, proxies, registrars, redirect servers as well as back-to-back user agents. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sipclf-problem-statement There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-sipclf-problem-statement-12 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sipclf-problem-statement-12 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From vkg@bell-labs.com Mon Dec 24 13:29:50 2012 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3F4121F8630 for ; Mon, 24 Dec 2012 13:29:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -109.255 X-Spam-Level: X-Spam-Status: No, score=-109.255 tagged_above=-999 required=5 tests=[AWL=1.344, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4xtsracoF7LK for ; Mon, 24 Dec 2012 13:29:50 -0800 (PST) Received: from ihemail2.lucent.com (ihemail2.lucent.com [135.245.0.35]) by ietfa.amsl.com (Postfix) with ESMTP id 5B14321F861B for ; Mon, 24 Dec 2012 13:29:48 -0800 (PST) Received: from usnavsmail4.ndc.alcatel-lucent.com (usnavsmail4.ndc.alcatel-lucent.com [135.3.39.12]) by ihemail2.lucent.com (8.13.8/IER-o) with ESMTP id qBOLTliW026394 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL) for ; Mon, 24 Dec 2012 15:29:48 -0600 (CST) Received: from umail.lucent.com (umail-ce2.ndc.lucent.com [135.3.40.63]) by usnavsmail4.ndc.alcatel-lucent.com (8.14.3/8.14.3/GMO) with ESMTP id qBOLTl5v003173 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Mon, 24 Dec 2012 15:29:47 -0600 Received: from shoonya.ih.lucent.com (shoonya.ih.lucent.com [135.185.237.229]) by umail.lucent.com (8.13.8/TPES) with ESMTP id qBOLTkpN029853 for ; Mon, 24 Dec 2012 15:29:47 -0600 (CST) Message-ID: <50D8C9B4.4050501@bell-labs.com> Date: Mon, 24 Dec 2012 15:31:32 -0600 From: "Vijay K. Gurbani" Organization: Bell Laboratories, Alcatel-Lucent User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: "sip-clf@ietf.org" Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.57 on 135.245.2.35 X-Scanned-By: MIMEDefang 2.64 on 135.3.39.12 Subject: [sip-clf] Problem statement revision post IESG review X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Dec 2012 21:29:50 -0000 All: I have posted a revision (-12) for the SIP CLF Problem Statement draft that incorporates the IESG comments. -12 can be accessed at http://tools.ietf.org/html/draft-ietf-sipclf-problem-statement-12 The diff between -11 and -12 is at http://tools.ietf.org/rfcdiff?url2=draft-ietf-sipclf-problem-statement-12.txt While most changes are editorial in nature, there are two changes that I want to intimate the working group. In S8.1, the following change was made based on an AD review: OLD: From - The From URI. For the sake of brevity, URI parameters SHOULD NOT be logged. To - The To URI. For the sake of brevity, URI parameters SHOULD NOT be logged. NEW: From - The From URI. For the sake of brevity, URI parameters should not be logged. To - The To URI. For the sake of brevity, URI parameters should not be logged. For the purpose of the SIP CLF record, the To and From URIs and the tags, as header parameters, are important. Whether or not to log other URI parameters depends on the implementation; certainly terseness dictates that an unadorned To or From URI is easy for visualization as the CLF records scroll by. Please let me know if there are any concerns with respect to this change. Thank you, - vijay -- Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent 1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60563 (USA) Email: vkg@{bell-labs.com,acm.org} / vijay.gurbani@alcatel-lucent.com Web: http://ect.bell-labs.com/who/vkg/ From dromasca@avaya.com Tue Dec 25 02:35:20 2012 Return-Path: X-Original-To: sip-clf@ietfa.amsl.com Delivered-To: sip-clf@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 184E521F86BA for ; Tue, 25 Dec 2012 02:35:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.924 X-Spam-Level: X-Spam-Status: No, score=-102.924 tagged_above=-999 required=5 tests=[AWL=-0.325, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1yLg-rci-Acu for ; Tue, 25 Dec 2012 02:35:15 -0800 (PST) Received: from p-us1-iereast-outbound.us1.avaya.com (p-us1-iereast-outbound.us1.avaya.com [135.11.29.13]) by ietfa.amsl.com (Postfix) with ESMTP id A3AB721F8614 for ; Tue, 25 Dec 2012 02:35:15 -0800 (PST) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AgAFAAEvoFDGmAcF/2dsb2JhbABEgmzAaYEIgh4BAQEBAgESKD8FBwQCAQgNBAQBAQEKFAUEBzIUCQgCBA4FCBqHYgYBCp4mjGSPHYwVhWlhA5wJijaCb4FkFx4 X-IronPort-AV: E=Sophos;i="4.80,759,1344225600"; d="scan'208";a="41957569" Received: from unknown (HELO co300216-co-erhwest.avaya.com) ([198.152.7.5]) by p-us1-iereast-outbound.us1.avaya.com with ESMTP; 25 Dec 2012 05:25:11 -0500 Received: from unknown (HELO AZ-FFEXHC01.global.avaya.com) ([135.64.58.11]) by co300216-co-erhwest-out.avaya.com with ESMTP; 25 Dec 2012 05:31:43 -0500 Received: from AZ-FFEXMB04.global.avaya.com ([fe80::6db7:b0af:8480:c126]) by AZ-FFEXHC01.global.avaya.com ([135.64.58.11]) with mapi id 14.02.0318.004; Tue, 25 Dec 2012 05:35:15 -0500 From: "Romascanu, Dan (Dan)" To: "Vijay K. Gurbani" Thread-Topic: [sip-clf] Last Call: (The Common Log Format (CLF) for the Session Initiation Protocol (SIP): Framework and Data Model) to Proposed Standard Thread-Index: AQHN4glSBsjFEtLFIUC61GjkDxUW+JgpUpzw Date: Tue, 25 Dec 2012 10:35:14 +0000 Message-ID: <9904FB1B0159DA42B0B887B7FA8119CA051F66@AZ-FFEXMB04.global.avaya.com> References: <20121203204501.12217.39525.idtracker@ietfa.amsl.com> <9904FB1B0159DA42B0B887B7FA8119CA042028@AZ-FFEXMB04.global.avaya.com> <50D8A750.2020005@bell-labs.com> In-Reply-To: <50D8A750.2020005@bell-labs.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.64.58.45] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "sip-clf@ietf.org" Subject: Re: [sip-clf] Last Call: (The Common Log Format (CLF) for the Session Initiation Protocol (SIP): Framework and Data Model) to Proposed Standard X-BeenThere: sip-clf@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: SIP Common Log File format discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Dec 2012 10:35:20 -0000 Hi Vijay, Thank you for addressing my comments. The proposed clarifications are very = good and address my concerns and unclarities.=20 Regards, Dan > -----Original Message----- > From: Vijay K. Gurbani [mailto:vkg@bell-labs.com] > Sent: Monday, December 24, 2012 9:05 PM > To: Romascanu, Dan (Dan) > Cc: ietf@ietf.org; sip-clf@ietf.org > Subject: Re: [sip-clf] Last Call: 11.txt> (The Common Log Format (CLF) for the Session Initiation Protocol > (SIP): Framework and Data Model) to Proposed Standard >=20 > Dan: Thank you for your review of the SIP CLF problem statement draft. > I appreciate your time and resulting comments. >=20 > Please see inline on resolution of your comments. I will be releasing > an updated version of the draft shortly with the resolutions contained > herein. >=20 > On 12/17/2012 10:02 AM, Romascanu, Dan (Dan) wrote: > > Hi, > > > > I believe that this is a good document and I support its approval. > > > > I do have a number of issues which I suggest to take into > consideration before approval and publication: > > > > 1. In Section 4: > > > > The SIP CLF is amenable to easy parsing and lends itself well to > > creating other innovative tools. > > > > I am not sure what this sentence really says. What does 'easy parsing' > mean? The previous paragraph referred to 'quick parsing (i.e., well- > delimited fields)' - quick parsing is a relative notion but at least > there was an example. Here, I do not know. > > > > What does 'other innovative tools' means escapes me totally. Why > 'other'? 'other' than what? And what 'innovative tools' means? >=20 > I have changed the text to address your comment. The change is as > follows: >=20 > OLD: >=20 > The SIP CLF is amenable to easy parsing and lends itself well to > creating other innovative tools. >=20 > NEW: >=20 > Due to the structure imposed by delimited fields, the SIP CLF is > amenable to easy parsing and lends itself well to creating other > innovative tools such as logfile parsers and trend analytic engines. >=20 > > 2. In Section 11 > > > > SIP CLF log files will take up substantive amount of disk space > > depending on traffic volume at a processing entity and the amount > of > > information being logged. As such, any organization using SIP CLF > > should establish operational procedures for file rollovers as > > appropriate to the needs of the organization. > > > > Procedures for file rollovers is not enough - actually there need to > be in place procedures for periodic retrieval of logs before rollover. >=20 > Added the phrase "periodic retrieval of logs before rollover" in S11. >=20 > > 3. [RFC3261] needs to be a Normative Reference. All this document > speaks about logs for SIP, refers to SIP entities, messages, fields in > the SIP messages - on short it cannot be understood and the SIP-CLF > cannot be implemented without a good reading and understanding of > [RFC3261]. >=20 > I think it is a reasonable position that understanding rfc3261 is a pre- > requsite for implementing SIP CLF. I have made rfc3261 normative as you > suggest. >=20 > Once again, thank you for your time and review of this work. >=20 > - vijay > -- > Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent > 1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60563 (USA) > Email: vkg@{bell-labs.com,acm.org} / vijay.gurbani@alcatel-lucent.com > Web: http://ect.bell-labs.com/who/vkg/