1.7.1 - do we need to require common logging format? about asvs

[csfreak92]

Seems like a good point. Maybe a common logging format is preventing log injection issues? Just thinking of possible cases why this was required.

[jmanico]

Seems like a good point. Maybe a common logging format is preventing log injection issues? Just thinking of possible cases why this was required.

A common logging format is different than the encoding needed to stop log injection.

[elarlang]

Seems like a good point. Maybe a common logging format is preventing log injection issues? Just thinking of possible cases why this was required.

Like Jim said, log injection is a different topic and it is covered by 7.3.1:

#	Description	L1	L2	L3	CWE
7.3.1	Verify that all logging components appropriately encode data to prevent log injection. (C9)		✓	✓	117

Common logging format is helpful for log readers for log correlation - if you watch/import 2 different log sources/files, you can align the same type of information. Nowadays there are every kind of log readers available that provides "adapters" - so that is why I opened the issue - do we actually need to require it?

[tghosth]

Sounds like a basic but important requirement to me

[elarlang]

To be clear, I don't want to remove it. I think it requires an exception for log readers which can work as adapters and read different formats.

Something like:
Verify that logs are readable and correlatable for the used log reader, preferably by using a common logging format.

[tghosth]

I can support that