Re: [logs] Syslog payload format

Previous message: Darin.MARAISat_private: "[logs] FW: ps. need help with some tools for log analogy"
In reply to: Marcus J. Ranum: "Re: [logs] Syslog payload format"
Next in thread: Frank O'Dwyer: "RE: [logs] Syslog payload format"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

bazsiat_private

On Mon, Dec 30, 2002 at 07:29:38PM -0500, Marcus J. Ranum wrote:
> 
> ><event user="marcus" tty="ttyp6" host="ranum.com">User logged in</event>
> 
> Then what's the point of <event>? Why not just
> log:
> 
> user="marcus" tty="ttyp6" host="ranum.com" event="user logged in"
> 
> Unnecessary complexity isn't going to make things easier. By mixing
> HTML-oid markup with thing=thing markup you now have 2 kinds of
> parsing to do.
> 
> Pick ONE kind of parsing and stick with it. Compression makes all
> the redundant <> </> stuff or x="" stuff go away for all intents
> and purposes anyhow.

*Sigh* I meant the above message as an example only. The exact markup used is
irrelevant, markup itself is important.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis