1. Robert Horn, Agfa Healthcare
RESTful Log Delivery
Robert Horn, Agfa Healthcare

2. The Problem ATNA Audit Log Repository RESTful Retrieve RESTful Push
(missing)
Audit Consumer
It is very inconvenient to send data to an Audit Consumer. They can only query.
Many analysis flows depend upon sending a set of data from the repository to an analysis system.

3. The Problem (Contd)
The RESTful structures used in RESTful query are missing the “PUT” operations that correspond the the “GET” operations defined.
Options:
Solve for only Syslog format. This has been asked for.
Also solve for the ATNA/FHIR format selection. This would be a profiling of FHIR. The question is whether there is user demand for this at the present. Or, should this wait until FHIR is out of DSTU. (Generating CP’s for FHIR changes is a resource burden on ITI. If this can wait, there will be fewer CPs.)
Standards alternatives:
Continue with the FHIR and Syslog formats.
Examine whether other formats are becoming standards. So far Linux (systemd/journalctl), windows (microsoft unified logging), Android (java logging), Apple (syslog is being replace by apple unified logging) are common for transferable data batching. Other approaches like Nagios, Flume, etc. are also common.
These other formats are emerging primarily to deal with both the increasing volume of logging data (especially Linux warehouse scale computing), and by power consumption considerations for battery powered devices. Syslog continuous network connections are a problem for battery powered devices.
Only Syslog has reached the level of finished recommended standard as IETF RFCs.

4. Value
Presently, downstream audit analysis of a subset of audit log event records requires either
inconvenient configuration as an audit repository,
Setup of special, often difficult, query combinations
Non-standard less interoperable “push” formats.
A standard push format will simplify life for audit analysis systems.

5. Work Effort Level
Selection of standard, minimal. We should stick with finished recommended standards. The examination of other formats is to determine how close they might be to finished recommended status.
Syslog format push, re-use current format specs pages for push spec. Note, this could include a file format spec for media exchange with another page.
FHIR format push, slightly more complex. 5 pages for push spec.