(as individual)

Overall, I think this is in excellent shape. I have a few specific observations/questions:

Last sentence of abstract could be simplified just to SIP devices? (In section 4 UA is explicitly mentioned - and it's not in the abstract which has a list of SIP server type devices). 

8.1 From/To Header
Both contain the statement "it is not necessary to log any URI parameters". 
Perhaps this should be in normative language? URI parameters MUST NOT be logged (they can be logged separately using an option field)

R-URI: URI parameters MUST be logged?

8.2 Is it necessary to indicate what a UAS-half and UAC-half are? I can see that for a proxy a request is both received and forwarded (although I am not sure I would use the term UAC-half for the sent side of a message.) As for a B2BUA I tend to think of the two sides as a UAC and a UAS (and not a "half")

[I have set aside the examples for now - I will finish reviewing that before the WGLC ends].

Cheers, 

Peter





On 2011-04-18, at 3:11 PM, Peter Musgrave wrote:

> Greetings CLF-ers,
> 
> I would like to start a two week WGLC on the problem statement doc (in accordance with our discussion in Prague). 
> 
> Please make you comments on the list by Wed. May 4th (I have added a few days to account for the Easter break). 
> 
> We need reviewers and fresh eyes - so if you can make time to read this it is much appreciated!
> 
> Thanks, 
> 
> Peter Musgrave
> Chair, sip-clf
> 
> Begin forwarded message:
> 
>> From: Internet-Drafts@ietf.org
>> Date: April 18, 2011 10:30:04 AM EDT
>> To: i-d-announce@ietf.org
>> Cc: sip-clf@ietf.org
>> Subject: [sip-clf] I-D Action:draft-ietf-sipclf-problem-statement-06.txt
>> 
>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>> This draft is a work item of the SIP Common Log Format Working Group of the IETF.
>> 
>> 
>> 	Title           : The Common Log Format (CLF) for the Session Initiation Protocol (SIP)
>> 	Author(s)       : V. Gurbani, et al.
>> 	Filename        : draft-ietf-sipclf-problem-statement-06.txt
>> 	Pages           : 34
>> 	Date            : 2011-04-18
>> 
>> Well-known web servers such as Apache and web proxies like Squid
>> support event logging using a common log format.  The logs produced
>> using these de-facto standard formats are invaluable to system
>> administrators for trouble-shooting a server and tool writers to
>> craft tools that mine the log files and produce reports and trends.
>> Furthermore, these log files can also be used to train anomaly
>> detection systems and feed events into a security event management
>> system.  The Session Initiation Protocol does not have a common log
>> format, and as a result, each server supports a distinct log format
>> that makes it unnecessarily complex to produce tools to do trend
>> analysis and security detection.  We propose a common log file format
>> for SIP servers that can be used uniformly by proxies, registrars,
>> redirect servers as well as back-to-back user agents.
>> 
>> A URL for this Internet-Draft is:
>> http://www.ietf.org/internet-drafts/draft-ietf-sipclf-problem-statement-06.txt
>> 
>> Internet-Drafts are also available by anonymous FTP at:
>> ftp://ftp.ietf.org/internet-drafts/
>> 
>> Below is the data which will enable a MIME compliant mail reader
>> implementation to automatically retrieve the ASCII version of the
>> Internet-Draft.
> <Mail Attachment>
>> _______________________________________________
>> sip-clf mailing list
>> sip-clf@ietf.org
>> https://www.ietf.org/mailman/listinfo/sip-clf
>