From: Nivedita Singhvi <niv@xxxxxxxxxx>
Date: Mon, 16 Jun 2003 15:45:20 -0700
[ I removed this kenistonj@xxxxxxxxxx from the CC:, it bounces... ]
I'd agree a lot of thought (and agreement :))has to go
into this before changing minor nits and stuff, and not
causing too much disruption..Evolution, as opposed to
revolution ;). I would hope that most wouldnt need changing..
There would be absolutely ZERO disruption if you guys would use you
brains and implement what you're actually trying to achieve, a system
event logging mechanism.
We have a message queueing mechanism using sockets, called netlink,
and you can make whatever actions in the kernel you think should be
monitored go and stuff messages into this system event netlink socket.
Then, you don't have to standardize a bunch of absolutely silly
strings (I mean, the concept is so incredibly stupid), you get events
that are in a precisely defined format going over this netlink socket.
Then whoever in userspace reads out the messages can interpret them
however the fuck it wants to. It is then trivial to parse the
messages and filter them. Furthermore, you could even transmit such
messages over a network connection to a remote logging server as-is.
And hey, look, for network links going up and down we have the hooks
already. Funny that...
|