Logging and Auditing

From Trust The Vote

Collecting ideas and thoughts

• Log should contain information about 'states' that the device enters and leaves, because these can be used to 'parse' the log to detect anomalies.
  • With a knowledge of the correct operation of the device, you can lay out a finite state machine of expected behavior
  • States are things like: "INITIAL BOOTUP", "POLLS OPEN, NO VOTES", "POLLS OPEN, SOME VOTES"
  • With those markers, then the sequence of other events that occur can be parsed and made some sense against the expected state machine
• Standardization or standards for logging
  • Why is it so critical that logging formats be 'standardized'?
• Integration of multiple device logging records
  • logging will happen throughout the day, at different locations
  • is it important that the logs somehow be combined?