On Tue, 3 Apr 2012 10:39:08 -0400 William Heinbockel wheinbockel@gmail.com wrote:
What I am cautious of is going too far down these routes as a project; it is very easy to start adding the fields/data from all of the individual protocols. What we should focus on is the most commonly used fields -- users, files, src/dst, time, etc.
Until developers start emitting CEE/luberjack, the field list we come up with will be used to map existing fields in log protocols and formats to. So IMO what we should do is take the most common N apps/protocols/formats such as Syslog , Windows EventLog, auditing (on linux, solaris, hpux etc), Android, checkpoint LEA, you name it. Then list up the fields used by these. Using this list, create a CEE/limberjack field list to which we can map these. Having done N, the N+1th will be likely pretty trivial to add.
The theoretical approach, namely that we come up with a field list we think will be useful, will fail at the very first encounter trying to put it in practice and normalize an existing log format to. Then you fix it, and again it will fail at the second. Instead of going through these iterations (the list I put in the wiki is a result of such), we should try to get it right with the practical approach. Maybe it won't look nice, because the list will be likely long and some will call it ugly, but will work better in practice and this is what users are after.
Regards, Botond