[Repost from an older thread on the sentinel-schema mailing list to solicit
more feedback from the communitiy]

I have come across these use cases:

1) In IDM we have

- Group ID
This is used by the IDM engine to tag all log events that occur during the
processing of a particular IDM event in a particular driver.

- Event ID (from the XDS DTD, not the NAudit field)
"An identifier used to tag the results of an event or command."
It is generated by the driver shim for publisher IDM events. For subscriber
IDM events, the Event ID is the one of the publisher IDM event that changed
the ID Vault or it is generated by the engine if the change to the IV vault
was made via LDAP.
The Event ID is also used to tie a <status> result to its originating IDM
event.

- Workflow Process ID
ID assigned to a particular instance of a workflow process (provisioning
request definition)

- Target Process ID
ID of a particular instance of a workflow process that was started from
another workflow process. Reported with the "start workflow" and "Role
Request Workflow" log events on the parent process.

- Correlation ID
ID that is provided to a called subprocess (start workflow, role request,
resource request) for reference to the parent. Reported with log event on
the child process.

- Request DN
ID of a particular role or resource request.



2) a Postfix/Amavis combination of MTA and Virus/Spam-Filter as present in
SLES uses

- Queue ID
This is the postfix internal id which is used to tag all events that occur
during the processing of a particular e-mail.

- message-id
This is the SMTP header which "provides a unique message identifier that
refers to a particular version of a particular message. The uniqueness of
the message identifier is guaranteed by the host that generates it". It can
be used to track a particular message across different relays.

- mail_id
This is the Amavis internal id which is used to tag all events that occur
during the processing of a particular e-mail. It is also used as filename of
quarantined e-mails.

- queued_as ID
E-mails are received by postfix, forwared to Amavis for inspection and -if
clean- forwarded again to a secondary postfix smtp listener on the same
host. The queued_as ID reported by Amavis is the Queue ID that is assigned
by the secondary postfix instance.



So I'd like to see a
- "Transaction ID" which is used to tag all log events that refer to a
single transaction within a particular service/host - pretty much our
current EventGroupID.
IDM Group ID, Workflow Process ID, Request DN, postfix Queue ID, and amavis
mail_id should be mapped to this.

- "Correlation ID" which is used to tie together distributed
transactions/processes.
IDM Event ID, Correlation ID, and SMTP message-id should be mapped to this.

- "Subrequest ID" which is the "Transaction ID" of a called subprocess and
is logged as an event on the parent process.
IDM Target Process ID and amavis queued_as ID should be mapped to this.