> I'm good with the definitions, except for the concept of an "event":

Same thing. Event is not necessarily "a state change." It is a
broader thing, basically, "something that happened" (even though a
state is the same - e.g. backup is proceeding, attack was seen, etc)

>
>> Event:
>> A discrete, distinct, and discernible state change in an
>> environment.
>
> In some aspects, state changes such as processes dieing or starting
> are surely events, but I also think that some logs which don't indicate
> a state change such as login failures, port scanning, intrusion
> detection logs, and so on are noteworthy and worth alerting on.
>
> Ron
>
>
>
>
>
>
>
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysis (at) loganalysis (dot) org [email concealed]
> http://www.loganalysis.org/mailman/listinfo/loganalysis
>

--
Anton Chuvakin, Ph.D., GCIA, GCIH, GCFA
http://www.chuvakin.org
http://chuvakin.blogspot.com
http://www.info-secure.org
_______________________________________________
LogAnalysis mailing list
LogAnalysis (at) loganalysis (dot) org [email concealed]
http://www.loganalysis.org/mailman/listinfo/loganalysis

[ reply ]