What questions can we ask of logs gathered

[cmharlow]

Reports / questions to ask of logs:

• Who queries what services? (How to define who here?)
• How often, broken down across querying agents or given timeframes?
• What queries? What frequency of queries?
• What queries are issued by the agent?

Break out per applications / machines being targeted in #5

[cmharlow]

Captured here rn: https://docs.google.com/document/d/1Gxi73V2TfZviOIc6yr4cEpcUWN55Jowcgu93VxoxrIY/edit#heading=h.g2n5kt23zu4v

Being surfaced in the Logs PoC PR: #27

High Level

1. SDR Object / Digital Repository Object a. ID (e.g., DRUID) a. ID Qualifiers (e.g. version) a. Model (can we even capture this? e.g. Hybox::Item vs Dor::Item && Dor::Publishable etc.)
2. Event / Process a. Creation or Deletion of a SDR Object a. Update of SDR Object (including relationship creation btwn Objects) a. Checks or Validations (e.g. checksums, file corruption, metadata profile validation, etc.) a. Name of Event / Process (service, interface, method) called
3. Status post-Event / Process a. Response Code a. Response Message a. Pass / Fall / Pending / … ?
4. Service / Process / Endpoint a. Who called it? a. When? a. What data shape was passed to it? a. What data shape did it pass back? a. What was the response code & message?

More Detail

1. What path does a SDR Object (identified by a DRUID) take from SURI assignment in Ingest / Dor-Services to completion (available for discovery if applicable & preserved)?
2. What data is passed for a SDR Object processed through applications, services, and/or interfaces?
3. What responses were given for data passed representing a SDR Object’s through a service, application, interface?
4. Where in our repository system is a given SDR Object at a given moment?
5. Where do errors around a SDR Object’s data shape begin versus where they block a process (full fail)?

[cmharlow]

To be confirmed once data is in an interface.