11–20 of 31 posts
The ` value ` in there makes me sad. It's better than the ` ` one of our partners uses at work but still... If there's a good reason for it, it's just as much of a good reason XML isn't suitable for what you're trying to do.
Free-form tag names invariably leads to conflicts with previously defined tags that are used for other purposes. I don't see how not wanting an unbounded number of different tags would be antithetical to use of XML.
Now to the original problem, what about a MAC framework for NT (other than the heap of crap known as MIC). Lets just log shit that the MAC framework didn't allow then.
SELinux, trusted solaris, OSX Mach, FreeBSD POSIX MAC for example.
Nope stuck in the dark ages because of win32...
(Yes i know NT can do this on its own but NT is just the runtime environment for win32 these days rather than the technical achievement it was).
Earlier quoted context omitted.
This is the first release of Sysmon. Perhaps you're thinking of Process Monitor?
I guess so. Strange sense of deja vu, but I will take your word for it.
I do everything to keep stuff out of the Windows event log because it's slow, impossible to query large swathes of data, noisy and difficult to get things to talk to it due to NT permissions and sources being stateful. Not only that you have to pay piles of cash for anything even slightly reliable for forwarding of logs (built in service for this is terrible) and the tooling is foul. Now to the original problem, what…
I think this might be a culture thing, because it's not actually impossible to do, it's just really rare to see. On Unix-like systems we're all use to be able to find text files with logging information for pretty much any system we deploy, on Windows we're accustomed to may programs and systems to be black boxes. If you as a Windows developer hasn't been exposed to having easily parsed text files with logging information, then changes are you don't know how to do good logging.
Also XML is pretty crappy for logging, either you have a million documents, or you have one large document that won't easily fit into Logstash, Splunk and similar tools.
I do everything to keep stuff out of the Windows event log because it's slow, impossible to query large swathes of data, noisy and difficult to get things to talk to it due to NT permissions and sources being stateful. Not only that you have to pay piles of cash for anything even slightly reliable for forwarding of logs (built in service for this is terrible) and the tooling is foul. Now to the original problem, what…
No only is the Windows Event Log impossible to query, it's also pretty rare to see a software actually log anything useful on Windows. I'm not trying to bash Microsoft, it just seems more common for software developed for Windows to have bad/missing/useless logging. I think this might be a culture thing, because it's not actually impossible to do, it's just really rare to see. On Unix-like systems we're all use to be…
Indeed there is a whole huge market doing that (logging and correlating useful information) APM (Application Performance Monitoring). You can take a look at: Compuware, Riverbed, and New Relic.
Currently this market is fragmenting in analytics products such as Splunk + agents distributed by different vendors.
I do everything to keep stuff out of the Windows event log because it's slow, impossible to query large swathes of data, noisy and difficult to get things to talk to it due to NT permissions and sources being stateful. Not only that you have to pay piles of cash for anything even slightly reliable for forwarding of logs (built in service for this is terrible) and the tooling is foul. Now to the original problem, what…
I do everything to keep stuff out of the Windows event log because it's slow, impossible to query large swathes of data, noisy and difficult to get things to talk to it due to NT permissions and sources being stateful. Not only that you have to pay piles of cash for anything even slightly reliable for forwarding of logs (built in service for this is terrible) and the tooling is foul. Now to the original problem, what…
It's been awhile, but I know I was logging custom events to the Event Log over 10 years ago, and I'm pretty sure MMC (or whatever its successor might be called) allowed custom filters so that a person could select a particular slice of the log pie.
Syslog on a Linux box and some front end indexing using a python script and sqlite: 0.04s.
I could probably have built that for windows but it wouldn't be 55 lines of code including the error query page Python CGI and taken me about 40 minutes end to end...
(And I'm naff at python)
Earlier quoted context omitted.
It's not a deal-breaker, but value would indeed be nicer.
For a human to read maybe, but for some generic parsing where there are many diferent keys, I would say value is indeed better, also makes an XSD easier to create, if needed.
I do everything to keep stuff out of the Windows event log because it's slow, impossible to query large swathes of data, noisy and difficult to get things to talk to it due to NT permissions and sources being stateful. Not only that you have to pay piles of cash for anything even slightly reliable for forwarding of logs (built in service for this is terrible) and the tooling is foul. Now to the original problem, what…
The ` value ` in there makes me sad. It's better than the ` ` one of our partners uses at work but still... If there's a good reason for it, it's just as much of a good reason XML isn't suitable for what you're trying to do.