Awesome. I think the tag-based approach is very good: it allows for matching events that are, for example either ssh, login, or fail or a combination of them. This will be very convenient with a database backend such as MongoDB which has a built in query for 'give me the records with this and this tag'.<br>
<br>Wladimir<br><br><div class="gmail_quote">On Wed, Apr 6, 2011 at 3:09 PM, Rainer Gerhards <span dir="ltr"><<a href="mailto:rgerhards@hq.adiscon.com">rgerhards@hq.adiscon.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
It's finally done:<br>
<br>
<a href="http://blog.gerhards.net/2011/04/log-classification-with-liblognorm.html" target="_blank">http://blog.gerhards.net/2011/04/log-classification-with-liblognorm.html</a><br>
<br>
This is based on some older CEE ideas and not necessarily inline with what<br>
comes up. Also, I can think of a couple of more things that would be good to<br>
add. But at least we now have the core functionality.<br>
<br>
Feedback, as usual, appreciated. Official release will follow shortly, either<br>
today or tomorrow. Everything already available via git.<br>
<div class="im"><br>
Rainer<br>
<br>
> -----Original Message-----<br>
> From: <a href="mailto:lognorm-bounces@lists.adiscon.com">lognorm-bounces@lists.adiscon.com</a> [mailto:<a href="mailto:lognorm-">lognorm-</a><br>
> <a href="mailto:bounces@lists.adiscon.com">bounces@lists.adiscon.com</a>] On Behalf Of Wladimir van der Laan<br>
</div><div class="im">> Sent: Tuesday, March 22, 2011 12:33 PM<br>
> To: lognorm<br>
</div><div><div></div><div class="h5">> Subject: Re: [Lognorm] Identifying message types<br>
><br>
> Hello Rainer,<br>
><br>
> Thanks for the explanation. Looks like I was right in my feeling that this<br>
was<br>
> missing.<br>
><br>
> I understand your rationale to wait for CEE on this, though. I read their<br>
spec,<br>
> and they propose that the identification of a message includes object,<br>
action<br>
> and status. But they haven't defined exactly what these should be, neither<br>
> do they give any examples.<br>
><br>
> They still have quite a lot of definition work to to. Hopefully, it won't<br>
take too<br>
> long, a standard for logging is very badly needed, and the longer it takes,<br>
the<br>
> more developers will yet again come up with their own solutions.<br>
><br>
> I'm currently classifying all kinds of events in Zenoss Core, and realized<br>
that<br>
> when I was defining regexp patterns I could just as well tell it how to<br>
extract<br>
> out the interesting information for analysis and more useful presentation.<br>
> Which is how I got to this project.<br>
><br>
> Wladimir<br>
><br>
> BTW: great work on rsyslog.<br>
><br>
><br>
> On Tue, Mar 22, 2011 at 10:37 AM, Rainer Gerhards<br>
> <<a href="mailto:rgerhards@hq.adiscon.com">rgerhards@hq.adiscon.com</a>> wrote:<br>
><br>
><br>
> Hi Wladimir,<br>
><br>
> This is a good question and you are abosultely right -- this is<br>
currently<br>
> missing. In fact, the speace in front of the colon inside the<br>
rulebase is<br>
> reserved for tags, which is the classification you are looking for.<br>
> Liblognorm is in its infancy, though already quite useful in its<br>
current<br>
> state. I have paused development a bit for two reasons:<br>
><br>
> a) CEE needs to sort out some things -- I'd prefer to have some<br>
issues<br>
> solved<br>
> before continuing (and re-doing some work).<br>
> b) devel prio -- right now I am working hard on getting a new stable<br>
> v5<br>
> rsyslog out, and this is taking quite some toll<br>
><br>
> The feature you are asking for is definitely on the today list, and I<br>
> hope to<br>
> be able to work more on liblognorm within the next couple of weeks<br>
> (this year<br>
> has been very busy - and will be - at least until mid-april).<br>
><br>
> Rainer<br>
><br>
><br>
> > -----Original Message-----<br>
> > From: <a href="mailto:lognorm-bounces@lists.adiscon.com">lognorm-bounces@lists.adiscon.com</a> [mailto:<a href="mailto:lognorm-">lognorm-</a><br>
> > <a href="mailto:bounces@lists.adiscon.com">bounces@lists.adiscon.com</a>] On Behalf Of Wladimir van der Laan<br>
> > Sent: Monday, March 21, 2011 7:00 PM<br>
> > To: <a href="mailto:lognorm@lists.adiscon.com">lognorm@lists.adiscon.com</a><br>
> > Subject: [Lognorm] Identifying message types<br>
> ><br>
> > Hello,<br>
> ><br>
> > I have a question about the usage of lognorm. As I understand, the<br>
> > program extracts data fields from log messages in text format, by<br>
> means<br>
> > of examples from a ruleset file. The output is represented as<br>
> metadata<br>
> > key/value pairs.<br>
> ><br>
> > But as far as I can see, it outputs no identifier as to what kind<br>
of<br>
> > message the log line represents. For automated log processing, one<br>
> > would also need to identify the message, for example, as failed<br>
> > authentication, or dhcp request, etc.<br>
> ><br>
> > Am I overlooking something? Is it possible to add a message type<br>
> field<br>
> > in a ruleset?<br>
> ><br>
> > Greetings,<br>
> > Wladimir<br>
> ><br>
><br>
><br>
> _______________________________________________<br>
> Lognorm mailing list<br>
> <a href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
> <a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
><br>
><br>
<br>
_______________________________________________<br>
Lognorm mailing list<br>
<a href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
<a href="http://lists.adiscon.net/mailman/listinfo/lognorm" target="_blank">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
</div></div></blockquote></div><br>