RE: [logs] databasing log files

JBrown@private

I've stored the text records along the the MD5 hash and some other
metadata.  It's possible to validate individual entries this way.
For the group of messages as a whole, I've constructed a 'dataset'
table with metadata about a collection containing log entries
x through y.  The collection itself is also MD5 hashed.  This 
prevents deleting or inserting entries over an entire collection.

My $0.02USD,
jpb
===

-----Original Message-----
From: Ron Sweeney
To: loganalysis@private
Sent: 2/10/04 9:40 PM
Subject: [logs] databasing log files

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Recently, I have gone down the road of writing "engines" to grep on huge
amounts of log files and load them into a mysql instance to keep
pertinent
data.  It works out pretty slick this way for obvious reasons...

My question to this list however, what are the legal ramifications of
storing data externally and not keeping the log files in their native
format? Does the validity of the exception in the log file get stunted
when removed from its native format?

- --
 ---  -sween
| M | http://www.modelm.org
 ---  "force feedback computing since 1984."
<meta name="MSSmartTagsPreventParsing" content="TRUE">

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (FreeBSD)

iD8DBQFAKZY/43hoCoA0jEERAh/nAJ45dfd/ftTkVtvJ/8iKOL5gBLJ0ZgCg0DJ2
xWc3qczm0pv/mq1szoVqBKQ=
=xIFR
-----END PGP SIGNATURE-----

_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis

Note:  The information contained in this message may be privileged and
confidential and protected from disclosure.  If the reader of this message
is not the intended recipient, or an employee or agent responsible for
delivering this message to the intended recipient, you are hereby notified
that any dissemination, distribution or copying of this communication is
strictly prohibited.  If you have received this communication in error,
please notify us immediately by replying to the message and deleting it from
your computer. Thank you.  ThruPoint, Inc. 

_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis