[syslog-ng] pure-ftpd

[Martin Holste]

My votes:

> - many times there is just a question mark instead of the username.
> Should it still be stored in a variable (useracct.username) or only for
> the Logout lines, where it actually might get a useful value?

I would vote not to store the question mark since I think the ? is
equivalent to NULL, which is what would get logically stored anyway.

>
> - the "New connection" line has the same info (the IP address) twice.
> How should it be handled?

I'm not seeing the IP twice in the examples you provided.  If it is
indeed there twice, I guess the question is what the tag name is for
both.  If you weren't planning on having a tag for one of the two
occurrences, then I would say skip that one since it wouldn't make
sense without a tag name.

>
> - how should Anonymous login be handled?
> @QSTRING:useracct.username: @
> vs.
> <value name="usracct.username">Anonymous</value>
>

I think "Anonymous" should definitely get logged the same as any other
user name, since you would want to see that on reports.  Another
thought would be to maybe switch it to the IP address, but I don't see
how you would do that across log lines.