From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: Re: [RFC][PATCH] audit: log join and part events to the read-only multicast log socket Date: Wed, 29 Oct 2014 17:38:18 -0400 Message-ID: <20141029213818.GO20866@madcap2.tricolour.ca> References: <30ef5c1ba42b52953e5684a0322975c3f0fadc77.1412706089.git.rgb@redhat.com> <2131923.Byl8GhZuQt@x2> <1645943.LlOpH1gJUB@sifl> <1978142.LNMGsIevqD@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <1978142.LNMGsIevqD@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On 14/10/22, Steve Grubb wrote: > On Tuesday, October 21, 2014 06:30:24 PM Paul Moore wrote: > > On Tuesday, October 21, 2014 03:56:10 PM Steve Grubb wrote: > > Before we go to much farther, I'd really like us to agree that ordering is > > not important, can we do that? > > Its kind of doubtful we can do anything like this quickly. Maybe over time. > But for entirely new events, we can create some canonical order and use it. Good. Where do we start? Alphabetical order seems like an obvious but not very useful order. How about an order based on classes of fields and importance or length of data within them? Start with who (subject), did what (verb) to what (object) with what result. Within each of those, have a standard order. Can that go in the "Audit Event Parsing Library Specifications"? There is also the standardization of field keywords that has already had some action/correction. > -Steve - RGB -- Richard Guy Briggs Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545