Defining Log, Event, and Alert (Round 2)
|
|
1
2
|
|
Thank you for all of the great feedback and discussion.
After compiling all of the suggestions from both this list and the LogAnalysis list, we have gone through and revised the definitions. One thing of note is that we have added the concept of "event log" and "event record". This serves two purposes: 1) it acknowledges that logs are used for more than just recording events, and 2) it allows us to explicitly define that CEE is concerned with standardizing *event records*. Without further ado: 1. Event * An observable occurrence in a computer system. The classification of events may be dependent on the observer and domain. 2. Event Record * A persistent representation of the details of an individual event. --CEE standardizes the Event Record syntax and make recommendations as to which events and corresponding details should be recorded.-- 3. Event Log * A collection of time-stamped event records. 4. Log * A collection of event records and other informational data pertaining to a particular domain. A log may be electronic (e.g. stored in memory, disk, software, database, text file, etc), physical (e.g. on paper), or even verbal (e.g., "Between 10:00 and 10:01 we received a series of several thousand SYN packets that we acknowledged, but full TCP connections were not completed. At 10:02, our server resources exceeded the maximum tolerable level and crashed."). 5. Log Record * A single entry in a log. Entries may take the form of an Event Record, status or attribute report, debug data, or similar environmental information. 6. Alert (n): * A warning or notification to a user or system, usually indicating that some action should be taken in response to one or more events. 7. Alert (v): * The act of generating, transporting, or displaying a warning or notification. 8. Log (v): * The act of recording or storing one or more events. William Heinbockel Infosec Engineer, Sr. The MITRE Corporation 202 Burlington Rd. MS S145 Bedford, MA 01730 heinbockel@... 781-271-2615 |
||||||||
smime.p7s (4K)
|
|
||||||||
|
|
||||||||
|
|
||||||||
|
|
In reply to this post by Raffael Marty-3
Responses inline.
William Heinbockel The MITRE Corporation >-----Original Message----- >From: Raffael Marty [mailto:rmarty@...] >Sent: Thursday, 31 July 2008 13:08 >To: Heinbockel, Bill >Cc: cee-discussion-list CEE-Related Discussion >Subject: Re: [CEE-DISCUSSION-LIST] Defining Log, Event, and Alert >(Round 2) > >Good morning, > >Below are some things that I am unclear about: > >> 1. Event >> >> * An observable occurrence in a computer system. The >> classification of events may be dependent on the observer >> and domain. > >Why in a computer system? Are we sure there are no other systems >that >we want to include? > However, "An observable occurrence" is too broad. Eric suggested "An observable occurrence in an IT system" which, I think, imposes even more limitation than "computer system". In the CEE whitepaper, we used "electronic system"... is that a better term? >> 2. Event Record >> >> * A persistent representation of the details of an >> individual event. >> --CEE standardizes the Event Record syntax and make >> recommendations as to which events and corresponding >> details should be recorded.-- >> >> 3. Event Log >> >> * A collection of time-stamped event records. >> >> 4. Log >> >> * A collection of event records and other informational >> data pertaining to a particular domain. > >Log and Event Log? Why do we need both terms with slightly >different >definitions? Can we merge them into the same definition? >Otherwise, >there should be a definition on "informational data". What's that? > more than just "event records". In order to make this separation clear, we defined "event log" as a subset of a "log". Another possibility would be to just distinguish between "log records" (log entries) and "event records". Why do we need the different definitions for "log" and "event log"? 1. Not all log records are event records -- we may argue that all log records _should be_ event records, but in practice, this is not true 2. CEE only standardizes event records >> A log may be electronic (e.g. stored in memory, disk, >> software, database, text file, etc), physical (e.g. on >> paper), or even verbal (e.g., "Between 10:00 and 10:01 we >> received a series of several thousand SYN packets that we >> acknowledged, but full TCP connections were not completed. >> At 10:02, our server resources exceeded the maximum >> tolerable level and crashed."). >> >> 5. Log Record >> >> * A single entry in a log. Entries may take the form of an >> Event Record, status or attribute report, debug data, or >> similar environmental information. > >And if we don't merge log and event log, we need an "event record" >also. > >> 6. Alert (n): >> >> * A warning or notification to a user or system, usually >> indicating that some action should be taken in response to >> one or more events. > >The word "action" seems important here? How exactly does this >relate >to events? Is an alert an event? Is it persisted? Or does an alert >generate a log record? Sometimes? > >> 7. Alert (v): >> >> * The act of generating, transporting, or displaying a >> warning or notification. > >Do we need to define warning and notification? What's the >difference? > it synonymously with "log", "audit trail", etc. As Eric pointed out, alerts are notifications to the user (in terms of alert message boxes in Windows). So, an "alert" is not an event. An alert might be produced in response to an event, the displaying of an alert is an event, but "alert" is not synonymous with "event". It is just included hear to distinguish the point that alerts are separate from events. Thus could easily be removed. >> 8. Log (v): >> >> * The act of recording or storing one or more events. > >Here, "log" refers to events? Isn't it to "generate an event >record"? Your right. However, I think that "to log" = "to generate a log record" It is possible to log non-event data, right? On second thought, are the definition of these verbs even necessary? |
||||||||
|
|
||||||||
|
|
>-----Original Message----- >From: David Corlette [mailto:DCorlette@...] >Sent: Thursday, 31 July 2008 14:38 >To: cee-discussion-list CEE-Related Discussion >Subject: [CEE-DISCUSSION-LIST] Fwd: Re: [CEE-DISCUSSION-LIST] >Defining Log, Event, and Alert (Round 2) > >>>Log and Event Log? Why do we need both terms with slightly >>>different >>>definitions? Can we merge them into the same definition? >>>Otherwise, >>>there should be a definition on "informational data". What's >that? >>> >> Many people (Dave, Tina, etc.) pointed out that logs hold more >than just "event records". In order to make this separation clear, >we >> defined "event log" as a subset of a "log". Another possibility >would be to just distinguish between "log records" (log entries) >and "event records". > >I think the problem is the word "log". Get rid of it. "Event >Stream" is a lot clearer. > >> Why do we need the different definitions for "log" and "event >log"? > >> 2. CEE only standardizes event records > >Bill, this is an important point. I think we need to make it >clearer which terms we are defining *for use by the standard* and >which terms we are defining *to exclude them from the standard*. >See Alert below as well. > 1. To better enable/organize the log community 2. Develop an event log standard My primary purpose for these definitions is to "standardize" our terminology. I could easily remove the bit about CEE and the document applies to the entire log community. This is why definitions for "log" and "alert" were included -- because they are actively used by the log community. While reading through yours (Dave's) and others' responses, I realized that the main issue (as you allude to) is that I was calling CEE a "log" standard. In order to better define the scope of CEE, I defined "event log". While I don't have any problems with renaming it to "event stream", I would anticipate the question of how is an "event stream" different from a "log"? I named it "event log" because everyone is familiar with the term "log", "event log" naturally implies that "event log" is a specific type of "log", and I am hesitant to add more synonyms to a community already navigating log, audit, audit log, and audit trail. Though, initially I had named "event log" as "event expression" to get away from the conceptual notions of log (as you point out) and to make the obvious tie to CEE... So, I think that all of these definitions should not be *for* the standard. They should be for the logging community (loganalysis, etc.) and are necessary for the scoping and development of CEE. |
||||||||
|
|
In reply to this post by Sanford Whitehouse
|
||||||||
|
|
In reply to this post by heinbockel
|
||||||||
|
|
In reply to this post by David Corlette
|
||||||||
|
|
In reply to this post by heinbockel
|
||||||||
|
|
In reply to this post by Eric Fitzgerald
|
||||||||
|
|
|
||||||||
|
In reply to this post by heinbockel
|
||||||||
|
|