Subject: [sip-clf] Looking at IPFIX logs

From: Peter Musgrave <[email-masked]>
Date: Wed, 4 Aug 2010 07:55:21 -0400

Hi Brian,

Speaking as an individual implementor - if IPFIX is adopted the first
thing I am going to want to do is find a way to sift through logs for
specific info and dump it out into text of some form (since I am very
likely ssh-ed onto the box in question a graphical viewer does not
help me that much).

Is there a standard open-source tool I would use for this - or would I
need to "roll my own"? Do you have any recommendations?

Regards,

Peter Musgrave
(as individual)

---

From: Brian Trammell <[email-masked]>
Date: Wed, 4 Aug 2010 15:04:08 +0200

hi Peter, all,

There is presently no widely-used standard open-source tool for reading arbitrary IPFIX. Most of what's out there has an IPFIX implementation (which is generic but not necessarily runtime-reconfigurable) combined to a specific internal data model; these are to date flow-oriented. 

The rfdump utility included with ripfix, http://ripfix.sourceforge.org/, (which I wrote and maintain and which we (the SIPCLF-IPFIX authors) use for example generation) can do generic dumping. But this is probably not what you want, either; what you want is a sipclf-specific command-line tool.

If IPFIX is adopted, one of the first things I would want to do is to create a reference implementation based on ripfix: one tool which would take (relatively plain vanilla) SIP headers and turn them into SIPCLF log entries, for generating test information; and one tool which would read SIPCLF logs, perhaps apply simple filters, and dump one-entry-per-line in a human readable, probably heavily inspired by the original sipclf format. This would be intended more as a guideline for implementors than a real production-ready tool (the r in ripfix stands for Ruby, and the core transcoder is presently quite slow, operating on pure Ruby arrays of bytes). But it would give you what you want in relatively short order. (The template and information model definitions in the IPFIX draft are runtime readable by ripfix. This is not an accident.)

Cheers,

Brian