Discussion

Survey Results

Ryan summarized his efforts in compiling the survey results into a concrete set of comparisons between diagnostic applications. This included an analysis of the platforms on which the applications ran, the coding language used, the design characteristics, and their relevance to the goals of the diagnostics project. Library dependences and API's were also considered.

His initial suggestions were borne out by this analysis: NetLogger, AirCERT, and Snort were the three applications most promising for these efforts. Snort's ruleset capabilities would provide immediate and good support for some of the logic surrounding common event records, and AirCERT provides good diagnostic tools. All three run at least on UNIX and most handle Windows.

Scott was not particularly concerned about the "taint" associated with using GPL'ed code: although some of these projects operate under GPL licenses, they wouldn't be linked against by any code written by the results of this workgroup, leaving them untainted. Insulation might also be provided by use of appender modules which would write the results out to the common log file on their own.