Re: Linux-audit Digest, Vol 47, Issue 12

On Wednesday 13 August 2008 12:25:09 Klaus Heinrich Kiwi wrote: > > I like Mathew's idea of having a binary format though. Maybe it's > > possible to carry the legacy format for some time while we have a more > > robust (and extensible) binary format in parallel? And then having a > > binary format version tag within each record? > Yes, there would have to be a migration path. I think we talked about XDR as a possibility 4 years ago because its already inside the kernel. The kernel guys at the time wanted to re-use something already inside or something that was compact in its representation. What I believe lead to text based was the general feeling that logs should be human readable with less, tail, or vi if need be. A problem with binary representations will be what happens with aggregated big-endian and little-endian system logs?