Linux-audit Digest, Vol 47, Issue 12
Randy Zagar
zagar at arlut.utexas.edu
Thu Aug 14 14:35:43 UTC 2008
On Wednesday 13 August 2008 13:02:05 Steve Grub wrote:
> On Wednesday 13 August 2008 12:25:09 Klaus Heinrich Kiwi wrote:
>> > I like Mathew's idea of having a binary format though. Maybe it's
>> > possible to carry the legacy format for some time while we have a more
>> > robust (and extensible) binary format in parallel? And then having a
>> > binary format version tag within each record?
>>
>
> Yes, there would have to be a migration path. I think we talked about XDR as a
> possibility 4 years ago because its already inside the kernel. The kernel
> guys at the time wanted to re-use something already inside or something that
> was compact in its representation.
>
> What I believe lead to text based was the general feeling that logs should be
> human readable with less, tail, or vi if need be.
>
> A problem with binary representations will be what happens with aggregated
> big-endian and little-endian system logs?
>
Aggregated logs from big-endian and little-endian systems should not be
a problem if you use XDR... the endian-ness of the cpu is completely
irrelevant.
IMHO, text would be preferable, but I don't have a dog in this fight...
-RZ
--
Randy Zagar Sr. Unix Systems Administrator
E-mail: zagar at arlut.utexas.edu Applied Research Laboratories
Phone: 512 835-3131 Univ. of Texas at Austin
More information about the Linux-audit
mailing list