LogAnalysis
RE: [logs] How to define Log, Event, and Alert? Jul 24 2008 04:43PM
Tina Bird (tbird precision-guesswork com)

> I guess the real problem is trying to describe something that is best
> described by referring to itself. For example, if you were asked to
> explain what a triangle looked like you'd probably have a hard time
> explaining it without somehow calling it a "triangular geometric
> shape".

Nah, triangles are easy -- they are three-sided objects, or objects composed
of three lines, in which each segment is connected to each of the other
segments at a single point, and in which the angles formed by the
intersections sum to 180 degrees (at least in a Euclidean space ;-)).

Rainer brought up a very good point regarding machine state -- time is a
variable, so in that sense, the combination of a "report" activity with a
given timestamp meets the definition of "state change." At least in some
rubbery sort of way, that allows us to incorporate reporting with more
active types of state changes, and thereby include them in the definition of
"event".

cheers -- t.
_______________________________________________
LogAnalysis mailing list
LogAnalysis (at) loganalysis (dot) org [email concealed]
http://www.loganalysis.org/mailman/listinfo/loganalysis

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus