As I stated in my last post, I think we should concentrate right now on what
services we want, not how to provide them. That will come later.
Accurate time reporting is very important. NTP is an implementation detail.
Other possibilities include keeping track of time differences between machines
and timestamping each entries with a separate stamp from each machine the entry
passed through.
d wrote:
> > [EMAIL PROTECTED] sez:
> > It's critically important that logs reflect the time events happened,
> > however most system clocks are wrong. So let's either build an xntp client
> > in the syslog server that atleast records the "real" time a message was
> > received.
>
> While I'd be the first to agree that time is critical for any sort of
> auditing or security, do people agree that accurate time (let alone
> specifying a specific format) should be part of a syslog specification?
> I'd initially vote against that as a design constraint, but I must
> confess I haven't given it a great deal of thought.
>
> Accurate network time is great, but I'd also like to think that people
> who aren't on the net (secure installations, uucp, factories, etc.) or who
> are otherwise NTP-challenged (and yes, I know you don't need to be on
> the net to use it) can use the new protocol.
>
> I guess it comes down to what problem - or set of problems - we're
> trying to solve.
>
> dan
--
Chris Calabrese
Internet Infrastructure and Security
Merck-Medco Managed Care, L.L.C.
[EMAIL PROTECTED]
.
