Re: How to define Log, Event, and Alert?

> I'm good with the definitions, except for the concept of an "event":

Same thing. Event is not necessarily "a state change."  It is a
broader thing, basically,   "something that happened" (even though a
state is the same - e.g. backup is proceeding, attack was seen, etc)


>
>> Event:
>>        A discrete, distinct, and discernible state change in an
>> environment.
>
> In some aspects, state changes such as processes dieing or starting
> are surely events, but I also think that some logs which don't indicate
> a state change such as login failures, port scanning, intrusion
> detection logs, and so on are noteworthy and worth alerting on.
>
> Ron
>
>
>
>
>
>
>
> _______________________________________________
> LogAnalysis mailing list
> [email protected]
> http://www.loganalysis.org/mailman/listinfo/loganalysis
>



-- 
Anton Chuvakin, Ph.D., GCIA, GCIH, GCFA
 http://www.chuvakin.org
 http://chuvakin.blogspot.com
 http://www.info-secure.org