Re: [logs] a small reminder

Victor.Fernandesat_private

My small contribution...

In my opinion before starting to formalize on what events to log, the
facilities to use, the data formats to use etc, we could first
categorize
the events we want to log.

Two main categories are obvious to me, Hardware and Software related
events.
From there we can order the events on subcategories, like:

Hardware
        Main System
                Motherboard
                        CPU
                                Cpu0 is too hot
                Cabinet
                        Cabinet
                                Front port Open
                PCI Bus
                        Card0
                                Not responding
.../...
        Disk Array
                Array0
                        Disk0
                                Down

Software
        Kernel
                Drivers
                        PCMCIA
                                Drivers not responding
.../...

        Print Services
                Spooler daemon
                        Queue Status
                                Queue X is full
        Network
                Driver
                        Status
                                Too many Half Open Connections
.../...

This will gives the possibility to easily filter what is important (at a
specific moment) and then order each event on different categories based
on
job roles or priorities (e.g. security related events - hardware or
software,
maintenance events, etc).

Best regards,

Victor Fernandes

Tina Bird wrote:
> 
> whilst i'm enjoying the conversation about log formats and transport
> mechanisms, i feel obliged to point out that when i kicked off discussion
> #1 on the path to world domination, i was trying to build a list of events
> we'd like to see logged.
> 
> as seems to be standard when we talk about logging, we have gone haring
> off after how to transport the data and how to parse the data and we've
> lost track of what bloody data we're after.  arguments about "could it be
> standardized" notwithstanding, sniff, sniff, surely >>someone<< out there
> has opinions about other things they'd like to see?
> 
> yours in attempting to maintain my thread -- tbird
> 
> "Wine is strong, the King is stronger, women are strongest, but TRUTH
>           conquers all."
> -----     Inscription in the Rosslyn Chapel (near Edinburgh, Scotland)
> 
> http://www.shmoo.com/~tbird
> Log Analysis http://www.counterpane.com/log-analysis.html
> VPN http://vpn.shmoo.com
> 
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysisat_private
> http://lists.shmoo.com/mailman/listinfo/loganalysis
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis