Re: How many projects support CEE

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

Re: How many projects support CEE

Ruben Oliva
You make a good point.  Two questions come to mind to address this issue.
1. How long is long enough for the stability to be reasonable?  or
2. What are the indicators of stability we should look for?
In my opinion, perhaps a good indicator is proprietary implementions of at least 50% of endorsers.
Endorsement and implementation of only one vendor would not help the events-concerned community.
(Ruben) David Oliva
On 07/03/12, Evan Rempel<[hidden email]> wrote:
Given William's question below I got to thinking that this is a chicken
and egg type question. Nobody wants to invest the energy into profiling
all of their events until they are confident that the event description
is stable, and without a clear winner in the event expression space,
nobody dedicates time to making it stable.

For years there have been projects that have attempted to standardize
logging and they have all failed. Partly due to the specifics of the
projects, but mostly because it took so long to stabilize the event
expressions that a new expression group started and it took momentum
away from it.

CEE is in an unprecedented place in that the tools to actually
implement the event expressions have just recently become available
(The structured log RFC, the lumberjack project, syslog-ng, ELSA, OSSEC etc.)

All of these have stated that they want to move forward using the CEE, but
if the CEE is not stable in time, these projects will not wait. They will
pick or invent a new standard, and since these projects, which are already
involved in a very significant amount of the Internet's logs (linux) they
will have mass adoption and will win the race regardless of merit.

Like Michael Starks wrote: "Let's fix this".

In my opinion, we only have short weeks before the next Linux releases come out
with some aspect of Lumberjack on them. As for my own in house project, I have even
less time.

I am not sure how much freedom I have in proposing changes to a 1.0alpha document, but
I will write up what I think is a reasonable change to the taxonomy.

Evan Rempel.

> [hidden email] wrote:
> Raffael Marty,
> How many device and or software companies are now considering or have
> processes in place to implement CEE? or do you think CEE is still
> needs a significant amount of work? Any interest from ArcSight, or
> EnVision in implementing.