gchq / event-logging-schema

Event Logging is an XML Schema for describing the auditable events generated by computer systems, hardware devices and access control systems
Apache License 2.0
25 stars 6 forks source link

Allow certain elements to have zero (0) text content values #6

Closed burnalting closed 7 years ago

burnalting commented 7 years ago

5 Refers:

This PR allows a number of elements that record counts to record 0 as a value where currently it only allows positive integers.

The justification is that source system events will sometimes provide 0 as a counter. For example Windows Print events can provide 0 for both Page and Printed Byte counters, Apache httpd can provide 0 for inbound or outbound byte counters as well as time counters. So if the source system considers 0 as a valid, the schema interpreting the event should honour this.

Further, downstream analysis capability, which is event source aware, may expect zero values and hence any Stroom event export translations will need to specifically address this if we don't allow zero values.