RE: How to define Log, Event, and Alert?
"Tina Bird" <[email protected]> Thu, 24 Jul 2008 11:43:43 -0500
| Newsgroups | gmane.comp.sysutils.loganalysis |
|---|---|
| Message-ID | <2F4D4CE71C5141B6B5F7AF2EC084D458@lindesfarne> |
> I guess the real problem is trying to describe something that is best > described by referring to itself. For example, if you were asked to > explain what a triangle looked like you'd probably have a hard time > explaining it without somehow calling it a "triangular geometric > shape". Nah, triangles are easy -- they are three-sided objects, or objects composed of three lines, in which each segment is connected to each of the other segments at a single point, and in which the angles formed by the intersections sum to 180 degrees (at least in a Euclidean space ;-)). Rainer brought up a very good point regarding machine state -- time is a variable, so in that sense, the combination of a "report" activity with a given timestamp meets the definition of "state change." At least in some rubbery sort of way, that allows us to incorporate reporting with more active types of state changes, and thereby include them in the definition of "event". cheers -- t.