Re: [RFC][PATCH] audit: log join and part events to the read-only multicast log socket

[Richard Guy Briggs <rgb@redhat.com>]

On 14/10/22, Steve Grubb wrote:
> On Tuesday, October 21, 2014 06:30:24 PM Paul Moore wrote:
> > On Tuesday, October 21, 2014 03:56:10 PM Steve Grubb wrote:
> > Before we go to much farther, I'd really like us to agree that ordering is
> > not important, can we do that? 
> 
> Its kind of doubtful we can do anything like this quickly. Maybe over time. 
> But for entirely new events, we can create some canonical order and use it.

Good.  Where do we start?  Alphabetical order seems like an obvious but
not very useful order.

How about an order based on classes of fields and importance or length
of data within them?  Start with who (subject), did what (verb) to what
(object) with what result.  Within each of those, have a standard order.
Can that go in the "Audit Event Parsing Library Specifications"?

There is also the standardization of field keywords that has already had
some action/correction.

> -Steve

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545