Re: How to define Log, Event, and Alert?

I'm good with the definitions, except for the concept of an "event":

> Event:
> 	A discrete, distinct, and discernible state change in an
> environment.

In some aspects, state changes such as processes dieing or starting
are surely events, but I also think that some logs which don't indicate
a state change such as login failures, port scanning, intrusion
detection logs, and so on are noteworthy and worth alerting on.

Ron