I'm good with the definitions, except for the concept of an "event":

> Event:
> A discrete, distinct, and discernible state change in an
> environment.

In some aspects, state changes such as processes dieing or starting
are surely events, but I also think that some logs which don't indicate
a state change such as login failures, port scanning, intrusion
detection logs, and so on are noteworthy and worth alerting on.

Ron

_______________________________________________
LogAnalysis mailing list
LogAnalysis (at) loganalysis (dot) org [email concealed]
http://www.loganalysis.org/mailman/listinfo/loganalysis

[ reply ]