[logs] Filebased logfiles vs. SQLbased logfiles

Previous message: Patrick Debois: "[logs] Re: Log integrity handling on central logsystem"
Next in thread: Anton Chuvakin: "[logs] Re: Filebased logfiles vs. SQLbased logfiles"
Reply: Anton Chuvakin: "[logs] Re: Filebased logfiles vs. SQLbased logfiles"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Patrick.Debois@private

I'm looking for help in a discussion to decide to either log everything
in relational database or just keep logs in plain files.

>From the file perspective:

    * (+)DB normalization with a lot of different DB schemas seems a lot
      of work/impossible. It feels a bit like the google vs yahoo approach.
    * (+)Easier to calculate checksums on files: database queries
    * (+)You would avoid understanding all logfiles and parsing them to
      an "uber"logformat
    * (+)Files index more easily then database.

_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis