Chapter 4 - DSpace at Waseda University

23
Chapter 3
event message that describes the event. For example, when a disk of a server becomes full,
the server could generate a time stamped “disk full” message for appending to a local log file
or for sending over the network as an SNMP trap. Event logging is a procedure of storing
event messages to the event log, where event log is a regular file that is modified by
appending event messages. (Although sometimes databases of event messages are also called
event logs) Log client is the system component that emits event messages for event logging.
In this thesis, the term event has often been used for denoting event messages when it is clear
from the context.
In modern IT systems, event logs play an important role:
� Since in most cases event messages are appended to event logs in real-time as they
are emitted by system components, event logs are an excellent source of information
for monitoring the system,
� Information that is stored to the event log can be useful for analysis at a later time,
e.g., for audit procedures or for retrospective incident analysis.
Event logging can take place in various ways. In the simplest case the log client keeps the
event log on a local disk and modifies it when an event occurs. Unfortunately, event logs will
be scattered across the system with this logging strategy, each log possibly requiring separate
monitoring or other analysis. Furthermore, the strategy assumes the presence of a local disk
which is not the case for many network nodes (e.g., switches and routers).
Figure 3.1 centralized logging infrastructure. This is the flow chart of the event log which