Re: [logs] Syslog payload format

Previous message: Balazs Scheidler: "Re: [logs] Syslog payload format"
In reply to: Balazs Scheidler: "Re: [logs] Syslog payload format"
Next in thread: Balazs Scheidler: "Re: [logs] Syslog payload format"
Next in thread: Frank O'Dwyer: "RE: [logs] Syslog payload format"
Reply: Balazs Scheidler: "Re: [logs] Syslog payload format"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

mjrat_private

><event user="marcus" tty="ttyp6" host="ranum.com">User logged in</event>

Then what's the point of <event>? Why not just
log:

user="marcus" tty="ttyp6" host="ranum.com" event="user logged in"

Unnecessary complexity isn't going to make things easier. By mixing
HTML-oid markup with thing=thing markup you now have 2 kinds of
parsing to do.

Pick ONE kind of parsing and stick with it. Compression makes all
the redundant <> </> stuff or x="" stuff go away for all intents
and purposes anyhow.

mjr. 
---
Marcus J. Ranum				http://www.ranum.com
Computer and Communications Security	mjrat_private

_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis