On Wednesday 13 August 2008 13:02:05 Steve Grub wrote:
On Wednesday 13 August 2008 12:25:09 Klaus Heinrich Kiwi wrote:
> I like Mathew's idea of having a binary format though. Maybe it's
> possible to carry the legacy format for some time while we have a more
> robust (and extensible) binary format in parallel? And then having a
> binary format version tag within each record?
Yes, there would have to be a migration path. I think we talked about XDR as a
possibility 4 years ago because its already inside the kernel. The kernel
guys at the time wanted to re-use something already inside or something that
was compact in its representation.
What I believe lead to text based was the general feeling that logs should be
human readable with less, tail, or vi if need be.
A problem with binary representations will be what happens with aggregated
big-endian and little-endian system logs?
Aggregated logs from big-endian and little-endian systems should not be
a problem if you use XDR... the endian-ness of the cpu is completely
irrelevant.
IMHO, text would be preferable, but I don't have a dog in this fight...
-RZ
--
Randy Zagar Sr. Unix Systems Administrator
E-mail: [EMAIL PROTECTED] Applied Research Laboratories
Phone: 512 835-3131 Univ. of Texas at Austin
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
