[Lognorm] getting started document

[david at lang.hm]

From: "Champ Clark III [Softwink]" <champ at softwink.com>

>On Mon, Jan 17, 2011 at 01:33:00PM -0800, david at lang.hm wrote:
>> the format of the rulebase files seems pretty straightforward, but 
>> where can I find the list of what datatypes are supported?
>
>        Keep in mind that liblognorm is pretty young at this point.
>So more documentation probably needs to be done.

that's what I figured, and why I posted what i found needed to be done 
rather than just griping about it :-)

>Also, there's not much in the way of rulebase files yet, but that will 
>likely change in the future.  Right now, you're probably going to have to 
>write your own rulebase files.

I expected to have to write my own rules, but it's hard to write rules 
without knowing what datatypes are available.

>When you do that, keep a copy so that you 
>can send them in later.  :)

I expect to send a bundch in as I work on things, although I also expect 
to be using the parsing library in ways that don't directly tie in to 
the 'big normalization' project.

For example, Rainer wondered out loud about the possibility of using this 
library for a rsyslog log parser instead of writing the parsers directly 
in C. in that case, most of what you want in terms of normalization won't 
matter, as that parser is just focused on figuring out what part of the 
blob that arrives is the message, and what metadata in included, not in 
parsing the message itself into different pieces.

>> also, where can I find an example of how to compile the rulebase, and 
>> an example program that uses the rulebase?
>
>        Check out "normalizer.c" with the liblognorm git.  It's a basic 
> program that does normalization.

will do.

can you point me at what file (or files) the datatypes are defined in?

David Lang
-------------- next part --------------
On Mon, Jan 17, 2011 at 01:33:00PM -0800, david at lang.hm wrote:
> the format of the rulebase files seems pretty straightforward, but where 
> can I find the list of what datatypes are supported?

	Keep in mind that liblognorm is pretty young at this point. 
So more documentation probably needs to be done.  Also,  there's not
much in the way of rulebase files yet,  but that will likely change
in the future.  Right now,  you're probably going to have to write your
own rulebase files.  When you do that,  keep a copy so that you can
send them in later.  :)

> also, where can I find an example of how to compile the rulebase, and an 
> example program that uses the rulebase?

	Check out "normalizer.c" with the liblognorm git.  It's a basic
program that does normalization. 

> 
> David Lang
> 
> On Mon, 17 Jan 2011, david at lang.hm wrote:
> 
> > documentation of how to get started is not easy to find (if it exists yet)
> >
> > I found how to download via git
> >
> > git clone git://git.adiscon.com/git/liblognorm liblognorm
> >
> > and then did autoreconf -fvi followed by ./configure but configure died 
> > because it needs libestr
> >
> > this seems to be available via git
> >
> > git clone git://git.adiscon.com/git/libestr libestr
> >
> > then did autoreconf -fvi followed by ./configure ; make ; make install
> >
> > I then found that libee is needed
> >
> >  git clone git://git.adiscon.com/git/libee libee
> >
> > autoreconf -fvi; ./configure ; make ; make install
> >
> > this finally let the ./configure; make ; make install work for liblognorm
> >
> >
> > now to hunt for how to use it ;-)
> >
> > David Lang
> >
> _______________________________________________
> Lognorm mailing list
> Lognorm at lists.adiscon.com
> http://lists.adiscon.net/mailman/listinfo/lognorm

-- 
        Champ Clark III | Softwink, Inc | 800-538-9357 x 101
                     http://www.softwink.com

GPG Key ID: 58A2A58F
Key fingerprint = 7734 2A1C 007D 581E BDF7  6AD5 0F1F 655F 58A2 A58F
If it wasn't for C, we'd be using BASI, PASAL and OBOL.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: not available
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20110117/d04c0641/attachment-0001.pgp>
-------------- next part --------------
_______________________________________________
Lognorm mailing list
Lognorm at lists.adiscon.com
http://lists.adiscon.net/mailman/listinfo/lognorm