Subject: [sip-clf] Defining Pros and Cons of ASCII/IPFIX

From: Peter Musgrave <[email-masked]>
Date: Wed, 27 Oct 2010 11:23:13 -0400

Hi all,

As co-chair I am looking for a way to make a determination about how to meet
the groups decision to move forward with just one format in a WG which has
good support for two formats.

In my (personal) opinion I think the objective is to develop something that
will be widely implemented. I would like to solicit input from a larger
audience - but first I think we need to frame the pros and cons.

I would like to suggest the following:

1) Use the list and the Beijing meeting to come to a consensus on the pros
and cons of each and the applications which may favour one format vs
another.

2) Place these pros/cons on the WG Wiki [I can act as editor]

3) Solicit input from SIP Implementors - referring them to the WG WIki
- use the Columbia sip-implementors, sipforum list and SIPT27

4) Review the feedback and try to come to a conclusion on the list (or
failing that, in Prague at IETF80)

I will be at SIPIT27 - so I can raise awareness of this discussion in that
community.

How do people feel about this approach?

I welcome any other/additional ways to resolve this issue.

Regards,

Peter Musgrave
co-chair

---

From: Hadriel Kaplan <[email-masked]>
Date: Wed, 27 Oct 2010 13:28:15 -0400

At a recent conference I asked a SIP monitoring vendor which format they thought we should specify, and surprisingly they said "do both".  I asked them why, and they said there was a market for both ascii and binary formats - that monitoring systems would prefer binary ones, but that humans prefer ascii style ones; and that in the Enterprise market ascii was more dominant, while in the SP market binary was more dominant.  They said we wouldn't be able to choose just one in the IETF - because whichever we picked there'd still be a market for the other and that market would continue the status-quo of proprietary formats or settle on some de-facto one.

In thinking about this more I think I agree with them.  It'd be like us picking a Registrar database access protocol as well as the fields in it - we could specify SQL or DIAMETER, but in some markets it'll be one not the other no matter which one we choose. (or it'll be Active Directory, etc.)

-hadriel

On Oct 27, 2010, at 11:23 AM, Peter Musgrave wrote:

> Hi all, 
> 
> As co-chair I am looking for a way to make a determination about how to meet the groups decision to move forward with just one format in a WG which has good support for two formats. 
> 
> In my (personal) opinion I think the objective is to develop something that will be widely implemented. I would like to solicit input from a larger audience - but first I think we need to frame the pros and cons.
> 
> 1) Use the list and the Beijing meeting to come to a consensus on the pros and cons of each and the applications which may favour one format vs another. 
> 
> 4) Review the feedback and try to come to a conclusion on the list (or failing that, in Prague at IETF80)
> 
> I will be at SIPIT27 - so I can raise awareness of this discussion in that community. 
> 
> <ATT00001..c>

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Wed, 27 Oct 2010 12:49:54 -0500

On 10/27/2010 10:23 AM, Peter Musgrave wrote:
> Hi all,
>
> As co-chair I am looking for a way to make a determination about how
> to meet the groups decision to move forward with just one format in a
> WG which has good support for two formats.

Peter: I know I am beating a dead horse, but I do want to point out
that it seems incongruous to come up with one format in a WG that has
good support for two.

Anyway, please see inline.

> In my (personal) opinion I think the objective is to develop
> something that will be widely implemented. I would like to solicit
> input from a larger audience - but first I think we need to frame the
> pros and cons.
>
> 1) Use the list and the Beijing meeting to come to a consensus on the
>  pros and cons of each and the applications which may favour one
> format vs another.
>

OK to above.

> 3) Solicit input from SIP Implementors - referring them to the WG
> WIki - use the Columbia sip-implementors, sipforum list and SIPT27

We need to solicit input from the larger log analysis community besides
groups related only to the IETF.

There is a Linked In group called "Log Analysis Professionals" group; we
could consider posting a survey there.  Plus, Usenix holds system log-
related workshops every year (see http://systemloganalysis.com/).  I
am sure that we can get some names of researchers (commercial as well
as academics) that work with system logs on a daily basis and approach
them for viewpoints (I would be willing to do this if we decide to
follow through with 3 above.)

> I welcome any other/additional ways to resolve this issue.

My $0.02 --- have both.  At the risk of raising RjS's ire, the
hum we took in the Anaheim meeting [1] indicated support for
both (at least it does to my sensibilities.)  For reasons I
don't quite understand, we went against that hum in Maastricht [2].

Both representations have good reasons to move forward as
they do backers and people who are willing to work on them.  I
understand the need to avoid the H.248/Megaco debate, but we
should not be blind to the fact that SIP CLF maybe a different
nail that should not be hit by the same hammer.

Having constant arguments on which is better and why we should
only pick one when two seem a better option are simply
counter-productive.

[1] http://www.ietf.org/proceedings/77/minutes/sipclf.htm
[2] http://www.ietf.org/proceedings/78/minutes/sipclf.txt

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/

---

From: Saverio Niccolini <[email-masked]>
Date: Thu, 28 Oct 2010 17:47:22 +0000

I am also in favor of specifying both, from a commercial perspective
this makes a lot of sense to give people in different markets what
they need.

Saverio

============================================================
Dr. Saverio Niccolini
Manager, Real-Time Communications Group
NEC Laboratories Europe, Network Research Division     
Kurfuerstenanlage 36, D-69115 Heidelberg
Tel.     +49 (0)6221 4342-118
NEC*NET Phone: 800-49-33-118
Fax:     +49 (0)6221 4342-155
e-mail:  [email-masked]
============================================================
NEC Europe Limited Registered Office: NEC House, 1 Victoria
Road, London W3 6BL Registered in England 2832014

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Hadriel Kaplan
> Sent: 27 October 2010 19:28
> To: Peter Musgrave
> Cc: List SIP-CLF Mailing
> Subject: Re: [sip-clf] Defining Pros and Cons of ASCII/IPFIX
> 
> 
> At a recent conference I asked a SIP monitoring vendor which format
> they thought we should specify, and surprisingly they said "do both".
> I asked them why, and they said there was a market for both ascii and
> binary formats - that monitoring systems would prefer binary ones, but
> that humans prefer ascii style ones; and that in the Enterprise market
> ascii was more dominant, while in the SP market binary was more
> dominant.  They said we wouldn't be able to choose just one in the IETF
> - because whichever we picked there'd still be a market for the other
> and that market would continue the status-quo of proprietary formats or
> settle on some de-facto one.
> 
> In thinking about this more I think I agree with them.  It'd be like us
> picking a Registrar database access protocol as well as the fields in
> it - we could specify SQL or DIAMETER, but in some markets it'll be one
> not the other no matter which one we choose. (or it'll be Active
> Directory, etc.)
> 
> -hadriel
> 
> pros and cons of each and the applications which may favour one format
> vs another.
> >
> WIki
> _______________________________________________
> sip-clf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sip-clf

---

From: Peter Musgrave <[email-masked]>
Date: Thu, 28 Oct 2010 13:55:57 -0400

Hi,

How do people feel about including one/both as an issue in the pros/cons
discussion and the effort to solicit wider input from implementors?

I think then if both gets continued support we can present that as input in
Prague and see where it goes.

If the pro/con idea has support then I can start the discussion with a
summary of what's been said thus far...

Regards

Peter Musgrave
(as co-chair)