Subject: [sip-clf] Implementation - Code and Results

From: Peter Musgrave <[email-masked]>
Date: Tue, 26 Oct 2010 07:02:41 -0400

HI all,

http://trac.tools.ietf.org/wg/sipclf/trac/wiki/WikiStart

contains some sample output files and the core Java code I used to generate
each log format.

My general feelings:
- indexed ASCII files are bigger (by about 1.5 x) but that's not a very big
factor when bytes on disk are so cheap (people coding on small devices may
feel differently)
- coding indexed ASCII logging is easier and the code is smaller
- IPFIX implementation required me to dig through some other docs
  (so for this to be accepted by implementors then I think sample code would
be mandatory)
- examining IPFIX files when debugging the logger was tedious (Hadriel's
wireshark plugin was very helpful here - he found several bugs in my IPFIX
logger)
  [but I think we all knew that a binary format would be like that]
- creating a python script to read indexed ASCII was very simple

I think the exercise was useful in that it did help sharpen each of the
implementation drafts.

I'll leave it to the chair to figure out how to move this forward.

Oh, wait, that's me....

Peter Musgrave
(as individual)

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Wed, 27 Oct 2010 09:33:04 -0500

On 10/26/2010 06:02 AM, Peter Musgrave wrote:
> contains some sample output files and the core Java code I used to
> generate each log format.

Peter: Very interesting.  Thanks for embarking on this exercise.
One comment inline.

> My general feelings:
> - indexed ASCII files are bigger (by about 1.5 x) but that's not a very
> big factor when bytes on disk are so cheap (people coding on small
> devices may feel differently)

Small devices (mobile phones running SIP) will not generate that much
traffic per day --- when compared to a SIP proxy --- to make the space
issue a deterrent.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/

---

From: Saverio Niccolini <[email-masked]>
Date: Wed, 27 Oct 2010 15:35:15 +0000

Vijay,

> traffic per day --- when compared to a SIP proxy --- to make the space

are we looking at log generated by small devices? there is not
so much you can analyze from them (unless you merge them, which 
is outside the scope of the charter now), the interesting part 
is to look at the SIP proxy logs...

Cheers,
Saverio

============================================================
Dr. Saverio Niccolini
Manager, Real-Time Communications Group
NEC Laboratories Europe, Network Research Division     
Kurfuerstenanlage 36, D-69115 Heidelberg
Tel.     +49 (0)6221 4342-118
NEC*NET Phone: 800-49-33-118
Fax:     +49 (0)6221 4342-155
e-mail:  [email-masked]
============================================================
NEC Europe Limited Registered Office: NEC House, 1 Victoria
Road, London W3 6BL Registered in England 2832014

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Vijay K. Gurbani
> Sent: 27 October 2010 16:33
> To: [email-masked]
> Subject: Re: [sip-clf] Implementation - Code and Results
> 
> _______________________________________________
> sip-clf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sip-clf

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Wed, 27 Oct 2010 10:57:00 -0500

On 10/27/2010 10:35 AM, Saverio Niccolini wrote:
> Vijay,
>
>> Small devices (mobile phones running SIP) will not generate that
>> much traffic per day --- when compared to a SIP proxy --- to make
>> the space issue a deterrent.
>
> are we looking at log generated by small devices? there is not so
> much you can analyze from them (unless you merge them, which is
> outside the scope of the charter now), the interesting part is to
> look at the SIP proxy logs...

Saverio: Absolutely.  I was merely responding to Peter's
note that people coding on small devices may feel differently
about space.

That said, I will point out that the way we have defined the
data model for SIP CLF, any SIP entity can use it --- proxy,
user agent server, user agent clients and everything in between.
Thus, it is not inconceivable that implementers for resource
constrained devices be interested in saving local logs of
calls being made.

Thanks,

- vijay