in case I have an event which does not describe a relation between two systems, e.g. the size of an Oracle table space or a filesystem size, should I use src_host or dest_host (or the other src/dest fields) for the host field in this events?
I never did find a clear statement in the documentation regarding these fields.
Clarification:
The cim model for inventory defines:
This is confusing, and to me it is not clear on how to use this fields, if i have an event from a host which describes just something on this hosts, like a table space, a filesystem, the serial number of this host and so on. It will have a host field, must I propagate this host field into src_host or dest_host. From my standpoint it would always be src_host (or src_ip, src_bunit and so on) and have no dst_* fields.
Hi FritzWittwer,
Sorry but I don't understand you need:
in host field there is the hostname of the system that produced the acquired logs;
why are you speaking of two systems? if the acquired logs are logs from a proxy or a web server, you could have other fields like src or dest, but host field it's always the same;
So could you share more information?
Bye.
Giuseppe
Hi FritzWittwer,
I think that you should maintain in your events the host field to know where the events lived.
And then understand how to use the other fields in your monitoring.
Bye.
Giuseppe