Re: [logs] Re: Generic Log Message Parsing Tool

From: Nick Vargish (navat_private)
Date: Wed Jun 05 2002 - 19:12:52 PDT

  • Next message: Sweth Chandramouli: "Re: [logs] Re: Generic Log Message Parsing Tool"

    On Wed, 5 Jun 2002, Marcus J. Ranum wrote:
    
    > My response to those who've drunken the XML cool-ade is similar
    > but for different reasons. :)
    
    Join us... join us... the grape is actually pretty good.
    
    > Uuuuhhh... I am still trying to see the
    > point of using XML for _anything_  ;)
    
    Somehow, I feel that was specifically meant for me. :^)
    
    XML is a bit more than just a standardized way of tagging data. The real
    value to XML is the ability to define the structure of the data by
    developing a DTD that describes the allowed document syntax. A good DTD
    can really help organize a development effort by directing the development
    of code to support the defined structure. It helps avoid some churning
    over dead-end approaches to the data, and helps developers write code
    under the same assumptions.
    
    One way to approach the problem of log parsing and analysis is to break
    messages into some generalized form that can consumed by arbitrary
    analysis engines. XML is a pretty good tool for that kind of approach,
    though it certainly loses in efficiency and brevity compared to a grammer
    developed specifically for this purpose.
    
    I do like XML, but it's not the only hammer in my toolchest.
    
    Nick
    
    --
    #include<stdio.h> /* SigMask 0.5 (sig.c) 20011019 PublicDomain */
    int main(c,v)char *v;{return !c?putchar(*v-1)&&main(0,v+1):main(0
    ,"Ojdl!Wbshjti!=obwAogs/dpn?!OGS!Tfojps!Tpguxbsf!Fohjoffs\v\1");}
    
    
    ---------------------------------------------------------------------
    To unsubscribe, e-mail: loganalysis-unsubscribeat_private
    For additional commands, e-mail: loganalysis-helpat_private
    



    This archive was generated by hypermail 2b30 : Wed Jun 05 2002 - 19:23:32 PDT