Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt

"Elwell, John" <john.elwell@siemens-enterprise.com> Wed, 04 May 2011 10:37 UTC

From: "Elwell, John" <john.elwell@siemens-enterprise.com>
To: Peter Musgrave <peter.musgrave@magorcorp.com>, "sip-clf@ietf.org Mailing" <sip-clf@ietf.org>
Date: Wed, 04 May 2011 12:37:48 +0200
Thread-Topic: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt
Thread-Index: Acv9/IOreUVRZrHnTQqksPPyvAtHjgMSEKbw
Message-ID: <A444A0F8084434499206E78C106220CA0876078C96@MCHP058A.global-ad.net>
References: <20110418143004.807.72505.idtracker@ietfc.amsl.com> <A4BBEEE4-4420-4A3A-BD0D-EE72430A6A64@magorcorp.com>
In-Reply-To: <A4BBEEE4-4420-4A3A-BD0D-EE72430A6A64@magorcorp.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt
Precedence: list

I wasn't able to do a complete review, but it looks in good shape. I noticed the following:

"From -  The From URI.  Whilst one may question the value of the From
      URI in light of RFC4744 [RFC4474], the From URI, nonetheless,
      imparts some information.  For one, the From tag is important and,
      in the case of a REGISTER request, the From URI can provide
      information on whether this was a third-party registration or a
      first-party one.  It is not necessary to log any URI parameters."
In fact the From tag is not part of the From URI. The From tag is covered in the next bullet, so we should not mention it here.

John


> -----Original Message-----
> From: sip-clf-bounces@ietf.org 
> [mailto:sip-clf-bounces@ietf.org] On Behalf Of Peter Musgrave
> Sent: 18 April 2011 20:12
> To: sip-clf@ietf.org Mailing
> Subject: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt
> 
> Greetings CLF-ers, 
> 
> I would like to start a two week WGLC on the problem 
> statement doc (in accordance with our discussion in Prague). 
> 
> Please make you comments on the list by Wed. May 4th (I have 
> added a few days to account for the Easter break). 
> 
> We need reviewers and fresh eyes - so if you can make time to 
> read this it is much appreciated!
> 
> Thanks, 
> 
> Peter Musgrave
> Chair, sip-clf
> 
> 
> Begin forwarded message:
> 
> 
> 	From: Internet-Drafts@ietf.org
> 	
> 	Date: April 18, 2011 10:30:04 AM EDT
> 	
> 	To: i-d-announce@ietf.org
> 	
> 	Cc: sip-clf@ietf.org
> 	
> 	Subject: [sip-clf] I-D 
> Action:draft-ietf-sipclf-problem-statement-06.txt
> 	
> 
> 	A New Internet-Draft is available from the on-line 
> Internet-Drafts directories.
> 	This draft is a work item of the SIP Common Log Format 
> Working Group of the IETF.
> 	
> 	
> 	Title           : The Common Log Format (CLF) for the 
> Session Initiation Protocol (SIP)
> 	Author(s)       : V. Gurbani, et al.
> 	Filename        : draft-ietf-sipclf-problem-statement-06.txt
> 	Pages           : 34
> 	Date            : 2011-04-18
> 	
> 	Well-known web servers such as Apache and web proxies like Squid
> 	support event logging using a common log format.  The 
> logs produced
> 	using these de-facto standard formats are invaluable to system
> 	administrators for trouble-shooting a server and tool writers to
> 	craft tools that mine the log files and produce reports 
> and trends.
> 	Furthermore, these log files can also be used to train anomaly
> 	detection systems and feed events into a security event 
> management
> 	system.  The Session Initiation Protocol does not have 
> a common log
> 	format, and as a result, each server supports a 
> distinct log format
> 	that makes it unnecessarily complex to produce tools to do trend
> 	analysis and security detection.  We propose a common 
> log file format
> 	for SIP servers that can be used uniformly by proxies, 
> registrars,
> 	redirect servers as well as back-to-back user agents.
> 	
> 	A URL for this Internet-Draft is:
> 	
> http://www.ietf.org/internet-drafts/draft-ietf-sipclf-problem-
> statement-06.txt
> 	
> 	Internet-Drafts are also available by anonymous FTP at:
> 	ftp://ftp.ietf.org/internet-drafts/
> 	
> 	Below is the data which will enable a MIME compliant mail reader
> 	implementation to automatically retrieve the ASCII 
> version of the
> 	Internet-Draft.
> 	
> 
>

[sip-clf] I-D Action:draft-ietf-sipclf-problem-st… Internet-Drafts
[sip-clf] WGLC:draft-ietf-sipclf-problem-statemen… Peter Musgrave
Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-stat… Peter Musgrave
Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-stat… Elwell, John
Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-stat… Peter Musgrave
Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-stat… Peter Musgrave
Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-stat… Gonzalo Salgueiro
Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-stat… Vijay K. Gurbani
Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-stat… Peter Musgrave