RFC 6872

The Common Log Format (CLF) for the Session Initiation Protocol (SIP): Framework and Information Model, February 2013

File formats:
icon for text file icon for PDF icon for HTML
V. Gurbani, Ed.
E. Burger, Ed.
T. Anjali
H. Abdelnur
O. Festor
sipclf (rai)

Cite this RFC: TXT  |  XML  |   BibTeX

DOI:  https://doi.org/10.17487/RFC6872

Discuss this RFC: Send questions or comments to the mailing list sip-clf@ietf.org

Other actions: Submit Errata  |  Find IPR Disclosures from the IETF  |  View History of RFC 6872


Well-known web servers such as Apache and web proxies like Squid support event logging using a common log format. The logs produced using these de facto standard formats are invaluable to system administrators for troubleshooting a server and tool writers to craft tools that mine the log files and produce reports and trends. Furthermore, these log files can also be used to train anomaly detection systems and feed events into a security event management system. The Session Initiation Protocol (SIP) does not have a common log format, and, as a result, each server supports a distinct log format that makes it unnecessarily complex to produce tools to do trend analysis and security detection. This document describes a framework, including requirements and analysis of existing approaches, and specifies an information model for development of a SIP common log file format that can be used uniformly by user agents, proxies, registrars, and redirect servers as well as back-to-back user agents.

For the definition of Status, see RFC 2026.

For the definition of Stream, see RFC 8729.

Advanced Search