From mboxrd@z Thu Jan  1 00:00:00 1970
From: LC Bruzenak <lenny@magitekltd.com>
Subject: Re: Cooked audit log format
Date: Mon, 12 May 2008 10:50:35 -0500
Message-ID: <1210607435.6847.14.camel@homeserver>
References: <482767E0.10506@redhat.com>
	<200805121043.17906.sgrubb@redhat.com> <48285C0C.5070809@redhat.com>
	<200805121119.46856.sgrubb@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <200805121119.46856.sgrubb@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Steve Grubb <sgrubb@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

Q: Will the (hopefully) soon-to-be released visualization tool have any
influence on this discussion? Also aggregation?

My hope is that I'd only look at human-readable audit data which is
aggregated on one central repository. For me that means the transfer
sizes are important. Ideally to me, the data would be raw/compressed and
sent to a common place with guaranteed delivery.

It would be at that point where the visualization, cooking, translating,
etc. occurs.  The more the better. :) 

Regardless, my original question was would more cooking find its way
into the visualization tool? And any idea of when that may be released?

LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com