Event Category -vs- Message ID
I was wondering what people's experience has been with using Event Category instead of MessageID's. (Note: I am using Content 2.0).
Since moving to 2.0 I have found the Category Names to be pretty good for Windows. I have specifically gotten a lot of use out of:
For me its certainly a lot easier for generating alerts and reports using this logic as opposed to having to input a list of Message IDs for each one.
We've been trying to use Event Category to build a correlated alert for "User Added" that works across all of our platforms using Event Categories. So far it's been hard due to inconsistencies with the Categorization used from device to device.
For example, on Linux, the 'useradd' command gets categorized into User.Management.Groups.Additions. Except if it fails, when it is placed into User.Management. I haven't been able to find a single event going into UM.Users.Additions, where I'd expect to find most useradd commands.
User.Management.Groups.Additions -- why is the user add event in the Groups category?
useradd: new user: name=user1, UID=109, GID=109, home=/home/user1, shell=/bin/bash
User.Management -- a failed event goes at the top level, not under 'Additions'
useradd: failed adding user `user1', data deleted
I also noticed that userdel shows up under UM.Groups.Deletions instead of UM.Users.Deletions.
User.Management.Groups.Deletions -- why is the delete user event in the Groups category?
userdel: delete user `user1'
Oracle, on the other hand, seems to have no User.Management messages at all...there we have to use MessageID lists.
I probably need to open a case on each platform to request better categorization...