I think many of legacy log format problems originated with
over-anticipation. Each log producers should determine their own level of
details which could change depending on situations. FTP server could avoid
writing out the <bytecount> element until it encounters failure situations.
For example, normal FTP entry could look like this:
<ftp:get file="/pub/xlf-spec.doc">
<ftp:start when="07/07/1998 12:24:48"/>
...
<ftp:end when="07/07/1998 12:30:00" error="12">
<xlf:bytecount>19989</xlf:bytecount>
</ftp:end>
</ftp:get>
[ Above example actually points to one of the problems of using XML.
Elements can not be nested too deep when there is more than one log producer
because start and end tags could get mixed up unless the log server prevents
the element from being written out until the end tag is received. ]
Regards,
Don