in case I have an event which does not describe a relation between two systems, e.g. the size of an Oracle table space or a filesystem size, should I use src_host or dest_host (or the other src/dest fields) for the host field in this events?
I never did find a clear statement in the documentation regarding these fields.
The cim model for inventory defines:
This is confusing, and to me it is not clear on how to use this fields, if i have an event from a host which describes just something on this hosts, like a table space, a filesystem, the serial number of this host and so on. It will have a host field, must I propagate this host field into src_host or dest_host. From my standpoint it would always be src_host (or src_ip, src_bunit and so on) and have no dst_* fields.
Sorry but I don't understand you need:
in host field there is the hostname of the system that produced the acquired logs;
why are you speaking of two systems? if the acquired logs are logs from a proxy or a web server, you could have other fields like src or dest, but host field it's always the same;
So could you share more information?
I think that you should maintain in your events the host field to know where the events lived.
And then understand how to use the other fields in your monitoring.