What is the difference between the Log Syntax and Log Transport?
Log Transport is the CEE component that is used to facilitate the exchange of logs, as represented by the Log Syntax. Log Syntax is the representation of the event data (including the taxonomy and syntax) in logs. The Log Transport specifies whether the logs are exchanged as files or via other protocols. The Log Syntax and Log Transport are two distinct components, but are dependent upon one another in certain instances. Some syntax options, such as XML-based syntaxes are limited to certain transport options like file-based or via SOAP. Due the XML verbosity, the transport cannot be Syslog. The Log Transport can be modified independent of the syntax to adjust to various network or transaction restrictions, such as low bandwidth or a firewall policy that only allows web and e-mail traffic. Additionally, the transport is where administrators can control encryption, reliability, or other transport-level options.
