RE: [logs] Syslog payload format

Previous message: Bennett Todd: "Re: [logs] RE: syslog/tcp (selp)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

brandonat_private

> As such, I intend to do the
> conversion so that I can design a single, generic back-end log parser
> and display system... 

Nice but reality often intrudes, I don't expect one thing will do
everything forever.

The apache example is good, sometimes KISS has value. If
we went to structured logging we'd have quite a bit of overhead
in dealing with the 3TB of apache logs we collect and
analyse monthly

The other stuff that we usually syslog is minute by comparison
but more diverse and so worth genericising to simplify handling

regards
brandon
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis