Message Metadata in DB
The request is that some of the metadata that appears in log files be organised in an accessible SQL db to simplify, and help secure the utilisation of the overall system.
My use case is as follows:
In an attempt to secure users primary emails I regularly run scripts to attempt to determine the source of authenticated sessions, and that they correspond to users and devices that are expected e.g. ActiveSync sessions from known devices and networks, or authenticated SMTP from known IPs or via authenticated VPNs.
These tasks end up parsing a lot of log files, where all of the info seems to reside.
However, it would be much easier if this metadata were stored in a queryable database.
A simple example - a QNAP NAS needs to have password details of an authenticated email account to send updates and details of security checks. Such NASes have had security holes that might have allowed them to be compromised. So I check that it only sends email to admins, and that this account only gets used from the NASes IP address.
This involves parsing the Dynamic screen log to check when an authenticated session starts, parsing the SMTP-in log to see the recipient and message number, and possibly the all log to check the title and other details.
These tasks would obviously be easier if they were a couple of queries! They would be dynamic and easier to protect rather than having log files copied around.