On Tue, 3 Apr 2012 10:39:08 -0400
William Heinbockel <wheinbockel(a)gmail.com> wrote:
What I am cautious of is going too far down these routes as a
project;
it is very easy to start adding the fields/data from all of the
individual protocols.
What we should focus on is the most commonly used fields -- users,
files, src/dst, time, etc.
Until developers start emitting CEE/luberjack, the field list we come up
with will be used to map existing fields in log protocols and formats to.
So IMO what we should do is take the most common N
apps/protocols/formats such as Syslog , Windows EventLog, auditing (on
linux, solaris, hpux etc), Android, checkpoint LEA, you name it.
Then list up the fields used by these. Using this list, create a
CEE/limberjack field list to which we can map these. Having done N, the
N+1th will be likely pretty trivial to add.
The theoretical approach, namely that we come up with a field list we
think will be useful, will fail at the very first encounter trying to
put it in practice and normalize an existing log format to. Then you
fix it, and again it will fail at the second. Instead of going through
these iterations (the list I put in the wiki is a result of such), we
should try to get it right with the practical approach. Maybe it won't
look nice, because the list will be likely long and some will call
it ugly, but will work better in practice and this is what users
are after.
Regards,
Botond