Currently, both subsystems log the hostname, the url (accesslog/path, watchdog/location: inconsistent), the uid and a timestamp.
Keeping the timestamp makes sense, especially if its granularity is improved using microtime() instead of time(), but it seems to me there would be much value in dropping the uid+hostname+location part and replacing them by accesslog.aid.
Not only would that spare some storage by dropping two columns, one of them a text blob after the pending patches, but it would also potentially improve our reporting/intrusion detection abilities, by associating behaviours with page cycles, not just users, especially since the uid can change in the course of a page cycle when masquerading but the aid typically won't.
I'm even going as far as assuming this is a critical feature to insert before the freeze, but feel free to reevaluate.
Comments
Comment #1
davyvdb commentedThis would make the dblog dependent on the statistics module. Not so much of a win imho.
Comment #2
fgmThinking a bit more upon it, both sites are typically disabled on larger sites anyway, and the current situation, although not optimal for the reasons outlined in the original post, is still usable, so the issue is hardly critical.
Comment #3
davyvdb commentedComment #4
jhedstromIt should be possible to relate these via views now I think.
Comment #5
fgm@jhedstrom : actually, at the time, the idea was to relate them at the storage level, since they both inherit a common set of information ; this hadn't much to do with querying them, although it was a consequence.
Technically, I would say the issue still exists, but the problem of having both mechanisms be optional means that something more fundamental would have to be rethought, binding logger calls to access entries, with the obvious problem that both are optional and both can be in separate storages.
Comment #6
jhedstrom@fgm, oh, that makes sense. Feel free to re-open. I was just trying to clean up old inactive issues :)