Saturday, July 14, 2007

Logs: Blast from the Past

At some point in this latest battle on loganalysis, Marcus Ranum thus spoke this about why syslog was invented and what happened next:
"Eric brought all the logs together in one place, and saw that
it was good, because they could then be processed with a
single invocation to the god 'rm'. And the system loggers
came, and bewailed the complexity of log data - because
it was all jumbled together. So the loggers girded up their
loins and burned many regexps and awk scripts in
sacrifice and were able to eventually separate the logs
into separate application-specific data sets, thereby
undoing the work of the Mighty Eric at great expense.
And they thought that it was good."

Read the rest of the very fun thread here.

No comments:

Dr Anton Chuvakin