Re: Linux-audit Digest, Vol 47, Issue 12

[Randy Zagar <zagar@arlut.utexas.edu>]

On Wednesday 13 August 2008 13:02:05 Steve Grub wrote:
> On Wednesday 13 August 2008 12:25:09 Klaus Heinrich Kiwi wrote:
>> > I like Mathew's idea of having a binary format though. Maybe it's
>> > possible to carry the legacy format for some time while we have a more
>> > robust (and extensible) binary format in parallel? And then having a
>> > binary format version tag within each record?
>>     
>
> Yes, there would have to be a migration path. I think we talked about XDR as a 
> possibility 4 years ago because its already inside the kernel. The kernel 
> guys at the time wanted to re-use something already inside or something that 
> was compact in its representation.
>
> What I believe lead to text based was the general feeling that logs should be 
> human readable with less, tail, or vi if need be.
>
> A problem with binary representations will be what happens with aggregated 
> big-endian and little-endian system logs?
>   
Aggregated logs from big-endian and little-endian systems should not be 
a problem if you use XDR...  the endian-ness of the cpu is completely 
irrelevant.

IMHO, text would be preferable, but I don't have a dog in this fight...

-RZ

-- 
Randy Zagar                               Sr. Unix Systems Administrator
E-mail: zagar@arlut.utexas.edu            Applied Research Laboratories
Phone: 512 835-3131                       Univ. of Texas at Austin