A standard audit trail format

The central role of audit trails, or (more properly) logs, in security monitoring needs little description, for it is too well known for any to doubt it. Auditing, or the analysis of logs, is a central part of security not only in computer system security but also in analyzing financial and other non-technical systems. As part of this process, it is often necessary to reconcile logs from different sources. This speaks of a need for a standard logging format. A standard log format robust enough to meet the needs of heterogeneity, transportability across various network protocols, and flexibility sufficient to meet a variety of needs in very different environments must satisfy two basic properties: extensibility and portability. This report presents the author`s proposed format for a standard log record. In section 3, he shows how and where the translation should be done, and in section 4 he demonstrates how log records from several disparate systems would be put into this format. Section 5 concludes with some observations and suggestions for future work