NetLogger only requires a timestamp, hostname and program name in each
event, and beyond that the names of the data elements are completely free-form.
In order to ease NTAF interoperability, I've come up with the following
'best practices'.
- NTAF events must use the following "well-known" fields:
VAL
- Log lines must have a field called VAL, whose value
is the "main" value for that event.
- WEB100 variables are of the types; counter, guage, integer, and
IP addr, these values should be logged as:
- counter :
VAL should be the delta between the now and the last call to update
this value
- gauge :
VAL should be the value of the guage, and the delta should be
sent as the variable DELTA
- integer:
VAL should be the integer
- IP addr:
VAL shoudl be the dotted decimal format
ID
- Log lines that want to be identified with (ie. grouped) with other lines
should set the same ID for all lines (in the case below I used
the process id for ID). The value may be a string or number. SRC
- Source of measured resource (e.g. link source). If absent, it is assumed
that the HOST is also the SRC. Therefore, all events in which the HOST and
SRC are different must have a SRC field.
DST
- Destination of the measured resource (e.g., link destination). All network
events should have a DST.
- HOST, SRC, and DST should be specified as IP addresses in dotted
decimal format.
- If including both a VAL and
a DELTA please use the name
DELTA for the delta.
Example for Web100 variables during an iperf from 10.1.10
to 10.1.1.11:
DATE=20020329210355.443568 HOST=10.1.1.10 PROG=nliperf NL.EVNT=SlowStart ID=2746 DST=10.1.1.11 VAL=2 DELTA=3
DATE=20020329210355.443568 HOST=10.1.1.10 PROG=nliperf NL.EVNT=SndLimTimeRwin ID=2746 DST=10.1.1.11 VAL=6 DELTA=0
DATE=20020329210355.443568 HOST=10.1.1.10 PROG=nliperf NL.EVNT=SndLimBytesRwin ID=2746 DST=10.1.1.11 VAL=1 DELTA=1
DATE=20020329210355.443568 HOST=10.1.1.10 PROG=nliperf NL.EVNT=SndLimTransRwin ID=2746 DST=10.1.1.11 VAL=5 DELTA=3