This chapter is concerned with the practical problem of collecting
data moderated by a service, which is to say service domain data.
At the conclusion of this chapter, you will be able to identify the
sources for service domain data and understand how vantage impacts this
data and the challenges to its validity.
What and Why
Practically speaking, service domain data consists of log data generated
by various services operating on a host. Service domain data is
characterized by the service’s moderation of things—where network
data deals in packets which may or may not do anything, service data
deals in events that are defined by the service. While data in the
host domain consists of the host’s current state, the service domain
contains the events that caused a state change.
Service data is therefore distinguished from the other categories by the impact
of a service moderating the information you receive. To understand
how this moderation impacts use, consider the scenario shown in
Figure 4-1. This figure shows how data in two domains is
generated for two different phenomena.
Figure 4-1. Comparing service and network domain data
On the left is a simple GET request via HTTPS. In this example, data is collected from two points: a span port on a switch collecting raw pcap, and the logs from the web server. Since the HTTPS packets are encrypted, ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month, and much more.
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.
Julian F.
Head of Cybersecurity
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.
Addison B.
Field Engineer
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.
Amir M.
Data Platform Tech Lead
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.
