mjr> If something doesn't generalize well (and I think I agree with mjr> Paul that this problem doesn't) then figure out how to make it mjr> _fast_ and _easy_ to be specific, with a minimum skill-set. I mjr> want something I can sit an intern in front of for a day and come mjr> away with a normal log-map and some token parsing rules for my mjr> site. I think that should be do-able. Yup. This seems doable in finite time and gives a way for most sites to have a good baseline. I think we all realize that "normal" will also change over time and all templates and rules will evolve/transmogrify. As long as we can still go back and reset "normal" fairly easily, the rules for "abnormal" will stay much more up to date and useful. _______________________________________________ LogAnalysis mailing list LogAnalysisat_private https://lists.shmoo.com/mailman/listinfo/loganalysis
This archive was generated by hypermail 2b30 : Tue Aug 20 2002 - 11:03:21 PDT