can you provide a link to these "latest best practices" of which you speak?
Nah, I was thinking in terms of behavior. Some (expensive) devices suck for detail on logging to the point of uselessness for forensic purposes, for instance. It'll compress a dozen criminal concepts into a single entry such as: "A user logged off"
can you provide a link to these "latest best practices" of which you speak?
The same reasons we don't have a standard file format for all applications.