Subject: Re: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt

From: "Elwell, John" <[email-masked]>
Date: Wed, 4 May 2011 12:37:48 +0200

I wasn't able to do a complete review, but it looks in good shape. I noticed the following:

"From -  The From URI.  Whilst one may question the value of the From
      URI in light of RFC4744 [RFC4474], the From URI, nonetheless,
      imparts some information.  For one, the From tag is important and,
      in the case of a REGISTER request, the From URI can provide
      information on whether this was a third-party registration or a
      first-party one.  It is not necessary to log any URI parameters."
In fact the From tag is not part of the From URI. The From tag is covered in the next bullet, so we should not mention it here.

John

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Peter Musgrave
> Sent: 18 April 2011 20:12
> To: [email-masked] Mailing
> Subject: [sip-clf] WGLC:draft-ietf-sipclf-problem-statement-06.txt
> 
> Greetings CLF-ers, 
> 
> I would like to start a two week WGLC on the problem 
> statement doc (in accordance with our discussion in Prague). 
> 
> Please make you comments on the list by Wed. May 4th (I have 
> added a few days to account for the Easter break). 
> 
> We need reviewers and fresh eyes - so if you can make time to 
> read this it is much appreciated!
> 
> Thanks, 
> 
> Peter Musgrave
> Chair, sip-clf
> 
> 
> Begin forwarded message:
> 
> 
> 	From: [email-masked]
> 	
> 	Date: April 18, 2011 10:30:04 AM EDT
> 	
> 	To: [email-masked]
> 	
> 	Cc: [email-masked]
> 	
> 	Subject: [sip-clf] I-D 
> Action:draft-ietf-sipclf-problem-statement-06.txt
> 	
> 
> 	A New Internet-Draft is available from the on-line 
> Internet-Drafts directories.
> 	This draft is a work item of the SIP Common Log Format 
> Working Group of the IETF.
> 	
> 	
> 	Title           : The Common Log Format (CLF) for the 
> Session Initiation Protocol (SIP)
> 	Author(s)       : V. Gurbani, et al.
> 	Filename        : draft-ietf-sipclf-problem-statement-06.txt
> 	Pages           : 34
> 	Date            : 2011-04-18
> 	
> 	Well-known web servers such as Apache and web proxies like Squid
> 	support event logging using a common log format.  The 
> logs produced
> 	using these de-facto standard formats are invaluable to system
> 	administrators for trouble-shooting a server and tool writers to
> 	craft tools that mine the log files and produce reports 
> and trends.
> 	Furthermore, these log files can also be used to train anomaly
> 	detection systems and feed events into a security event 
> management
> 	system.  The Session Initiation Protocol does not have 
> a common log
> 	format, and as a result, each server supports a 
> distinct log format
> 	that makes it unnecessarily complex to produce tools to do trend
> 	analysis and security detection.  We propose a common 
> log file format
> 	for SIP servers that can be used uniformly by proxies, 
> registrars,
> 	redirect servers as well as back-to-back user agents.
> 	
> 	A URL for this Internet-Draft is:
> 	
> http://www.ietf.org/internet-drafts/draft-ietf-sipclf-problem-
> statement-06.txt
> 	
> 	Internet-Drafts are also available by anonymous FTP at:
> 	ftp://ftp.ietf.org/internet-drafts/
> 	
> 	Below is the data which will enable a MIME compliant mail reader
> 	implementation to automatically retrieve the ASCII 
> version of the
> 	Internet-Draft.
> 	
> 
>

---

From: Peter Musgrave <[email-masked]>
Date: Wed, 4 May 2011 09:39:43 -0400

As promised here my "as individual" review of the examples:

In section 9.2:
        To: sip:[email-masked]
        R-URI: sip:[email-masked]
I am trying to reconcile these. It is not stated in the start that bob is registered to p2. I am assuming that p2 is authoritative for bob (Hence the value in the To: header) ?
Should the intro state that Bob is registered to p2?

Went through the rest fairly carefully. All looks good. 

Cheers, 

Peter Musgrave

On 2011-04-27, at 2:42 PM, Peter Musgrave wrote:

> (as individual)
> 
> Overall, I think this is in excellent shape. I have a few specific observations/questions:
> 
> Last sentence of abstract could be simplified just to SIP devices? (In section 4 UA is explicitly mentioned - and it's not in the abstract which has a list of SIP server type devices). 
> 
> 8.1 From/To Header
> Both contain the statement "it is not necessary to log any URI parameters". 
> Perhaps this should be in normative language? URI parameters MUST NOT be logged (they can be logged separately using an option field)
> 
> R-URI: URI parameters MUST be logged?
> 
> 8.2 Is it necessary to indicate what a UAS-half and UAC-half are? I can see that for a proxy a request is both received and forwarded (although I am not sure I would use the term UAC-half for the sent side of a message.) As for a B2BUA I tend to think of the two sides as a UAC and a UAS (and not a "half")
> 
> [I have set aside the examples for now - I will finish reviewing that before the WGLC ends].
> 
> Cheers, 
> 
> Peter
> 
> 
> 
> 
> 
> On 2011-04-18, at 3:11 PM, Peter Musgrave wrote:
> 
>> Greetings CLF-ers,
>> 
>> I would like to start a two week WGLC on the problem statement doc (in accordance with our discussion in Prague). 
>> 
>> Please make you comments on the list by Wed. May 4th (I have added a few days to account for the Easter break). 
>> 
>> We need reviewers and fresh eyes - so if you can make time to read this it is much appreciated!
>> 
>> Thanks, 
>> 
>> Peter Musgrave
>> Chair, sip-clf
>> 
>> Begin forwarded message:
>> 
>>> Subject: [sip-clf] I-D Action:draft-ietf-sipclf-problem-statement-06.txt
>>> 
>>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>>> This draft is a work item of the SIP Common Log Format Working Group of the IETF.
>>> 
>>> 
>>> 	Title           : The Common Log Format (CLF) for the Session Initiation Protocol (SIP)
>>> support event logging using a common log format.  The logs produced
>>> craft tools that mine the log files and produce reports and trends.
>>> detection systems and feed events into a security event management
>>> system.  The Session Initiation Protocol does not have a common log
>>> format, and as a result, each server supports a distinct log format
>>> analysis and security detection.  We propose a common log file format
>>> for SIP servers that can be used uniformly by proxies, registrars,
>>> http://www.ietf.org/internet-drafts/draft-ietf-sipclf-problem-statement-06.txt
>>> 
>>> implementation to automatically retrieve the ASCII version of the
>>> Internet-Draft.
>> <Mail Attachment>
>>> _______________________________________________
>>> sip-clf mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/sip-clf
>> 
>

---

From: Peter Musgrave <[email-masked]>
Date: Tue, 10 May 2011 11:41:17 -0400

I will extend the WGLC until Friday May 13th. 

If you can find to time to look at the doc - or even just the diffs and indicate you have done so, it would be appreciated. 

Regards, 

Peter Musgrave
Chair, SIP-CLF

Please try and

---

From: Gonzalo Salgueiro <[email-masked]>
Date: Tue, 10 May 2011 14:25:29 -0400

Peter - 

The document is ready IMO. My feedback and input to Vijay has been has been provided adhoc along the way and is reflected in the current draft.

Regards,

Gonzalo