On 04/16/2014 06:46 PM, Bill Nottingham wrote:
I understand the pull vs push distinction ... I'm just not clear
why pull
would ever be a model you'd want to use. (vs something like a local cockpit
agent.)
Isn't remote Windows event logging pull-only (unless you somehow gate it
to syslog)? So it would be consistent.
Back in the old days, there was a lot of loathing going around for
Windows event logging. People loved syslog, but really hated the
Windows counterpart. The pull model was criticized as well, but I'm not
sure if it was really pulling stuff or the bad interaction with other
design considerations (like the need for DLLs with parsers for the log
blobs).
Does anybody know what the current Windows experience is like,
especially related to the pull model?
--
Florian Weimer / Red Hat Product Security Team