Subject: [sip-clf] ASCII Logging

From: Peter Musgrave <[email-masked]>
Date: Sun, 14 Nov 2010 18:46:23 +0800

(as individual)

A couple of questions:

1) Do we want to keep this index pointers for this format (or was that just "index envy" to put the proposal on the same footing as IPFIX?)

2) If a field cannot be parsed a log entry would still be useful (src/dst should always be present). What should be logged for a field which failed to parse? "X" ?

3) (Admittedly an odd case). If a tag (or other field) is literally "-" then it will be interpreted as missing. (Likewise if "X" from above is adopted). Do we need to do an escape sequence for a literal "-" or "X" ??

Peter Musgrave

---

From: Hadriel Kaplan <[email-masked]>
Date: Sun, 14 Nov 2010 14:13:06 -0500

> 1) Do we want to keep this index pointers for this format (or was that just "index envy" to put the proposal on the same footing as IPFIX?)

No, get rid of the index line.  Make it easily readable by humans and grep. (since that's the main benefit of ascii)

> 2) If a field cannot be parsed a log entry would still be useful (src/dst should always be present). What should be logged for a field which failed to parse? "X" ?

Yeah we should pick one.  The character X makes as much sense as anything.

> 3) (Admittedly an odd case). If a tag (or other field) is literally "-" then it will be interpreted as missing. (Likewise if "X" from above is adopted). Do we need to do an escape sequence for a li…

That's because the fields aren't being wrapped with a "", which is what Apache's CLF does for fields which are strings from the message.  That way a received dash would be "-", whereas a indication of none would be just the dash -, and indication of unparseable would be just the character X.

I propose that the ascii format make all fields which are interpreted/derived not use "", but all fields which are the literal string use "".

So a log entry would look like:
<allOneLine>
0000000000.010 1 INVITE - "sip:192.168.217.74;foo=bar" 192.168.217.74:5060 192.168.217.117:56485 "sip:192.168.217.74" - "sip:[email-masked]" "DL88360fa5fc" "[email-masked]" server-tx client-tx
</allOneLine>

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 22 Nov 2010 15:46:29 -0600

On 11/14/2010 04:46 AM, Peter Musgrave wrote:
> (as individual)
>
> A couple of questions:
>
> 1) Do we want to keep this index pointers for this format (or was
> that just "index envy" to put the proposal on the same footing as
> IPFIX?)

No, it was not index envy.  IPFIX discussions arose much later
in the evolution of the work.

Whether or not to keep the index pointers is now for the WG to
decide.  There are advantages and disadvantages that folks are
already aware of and I am okay with going either way (i.e.,
with indexes or without.)

However, at the very least I think that we should keep the length
index to allow a reader to skip the entire record expeditiously
it does not match the Call-ID or dialogue-ID that is being sought.

> 2) If a field cannot be parsed a log entry would still be useful
> (src/dst should always be present). What should be logged for a field
> which failed to parse? "X" ?

We could put a "?" in fields that could not be parsed.

A "?" can appear in a SIP-URI production rule, however, an un-adorned
"?" as the only character in a SIPCLF field probably is a good
indication that something went wrong.

> 3) (Admittedly an odd case). If a tag (or other field) is literally
> "-" then it will be interpreted as missing. (Likewise if "X" from
> above is adopted). Do we need to do an escape sequence for a literal
> "-" or "X" ??

The "?" cannot appear in a tag.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/