<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
It depends on how you plan on doing regular expressions. If you
plan on using libpcre, then I'd say make it a build flag.
Probably disabled by default, since<br>
I doubt anyone wants liblognorm to be dependent on libpcre by
default. <br>
<br>
<br>
On 11/3/14, 6:54 PM, singh.janmejay wrote:<br>
<span style="white-space: pre;">><br>
> Alright, module loading flag it is then.<br>
><br>
> --<br>
> Regards,<br>
> Janmejay<br>
><br>
> PS: Please blame the typos in this mail on my phone's
uncivilized soft keyboard sporting it's not-so-smart-assist
technology.<br>
> <br>
><br>
> On Nov 4, 2014 3:42 AM, "David Lang" <<a class="moz-txt-link-abbreviated" href="mailto:david@lang.hm">david@lang.hm</a>
<a class="moz-txt-link-rfc2396E" href="mailto:david@lang.hm"><mailto:david@lang.hm></a>> wrote:<br>
><br>
> On Mon, 3 Nov 2014, singh.janmejay wrote:<br>
><br>
> I think module-loading call having a flag to turn
on/off would be better<br>
> than build-time flag, purely because it allows one to
build a package and<br>
> use it on several boxes, while keeping the feature
off when not required. A<br>
> more fine grained control, in that sense.<br>
><br>
><br>
> I was thinking in terms of something in the config file.
We need it to be something that the person configuring rsyslog
will see so that they know they are doing something slow. Most
users don't compile rsyslog so they won't ever see the compile
time flag.<br>
><br>
> module loading time seems fine.<br>
><br>
> David Lang<br>
><br>
> We can support both levels of enabling, but then a
lot of people may be<br>
> confused as to why it doesn't work when they turned
it on while building.<br>
><br>
> 2 levels also seems a little over-protective to me.
Kinda like Windows "do<br>
> you really want to delete this file" prompts.<br>
><br>
> Does module-loading time flag sound ok?<br>
><br>
> --<br>
> Regards,<br>
> Janmejay<br>
><br>
> PS: Please blame the typos in this mail on my phone's
uncivilized soft<br>
> keyboard sporting it's not-so-smart-assist
technology.<br>
><br>
> On Nov 3, 2014 10:52 PM, "singh.janmejay"
<<a class="moz-txt-link-abbreviated" href="mailto:singh.janmejay@gmail.com">singh.janmejay@gmail.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:singh.janmejay@gmail.com"><mailto:singh.janmejay@gmail.com></a>> wrote:<br>
><br>
> Hex was just an example. I meant when someone
needs to roll out something<br>
> very quickly, and it's not supported in the build
they have, it's useful to<br>
> be able to do it using regex in rulebase but
still completely working in<br>
> terms of rules, rather than having to resort to a
mix of rules and<br>
> exec-template calls with regexp based property
extractors etc.<br>
><br>
> It's still the same amount of work, if someone is
trying to do something<br>
> unsupported by lognorm. So performance effects
will still show, just not in<br>
> lognorm.<br>
><br>
> This allows for flexibility and clean way of
parsing logs at possibly even<br>
> slightly lesser cost then the former approach.<br>
><br>
> We can support a switch-on flag in conf
file(module loading call, may be)<br>
> which can be used to enable performance sensitive
features.<br>
><br>
> I personally think warning in logs would be
enough though.<br>
><br>
> --<br>
> Regards,<br>
> Janmejay<br>
><br>
> PS: Please blame the typos in this mail on my
phone's uncivilized soft<br>
> keyboard sporting it's not-so-smart-assist
technology.<br>
><br>
> On Nov 3, 2014 9:22 PM, "Champ Clark III"
<<a class="moz-txt-link-abbreviated" href="mailto:cclark@quadrantsec.com">cclark@quadrantsec.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:cclark@quadrantsec.com"><mailto:cclark@quadrantsec.com></a>> wrote:<br>
><br>
></span><br>
<blockquote type="cite">I think David means something like:<br>
<br>
./configure --enable-preformance-pigs<br>
<br>
I'm not a huge fan of this for a couple of reasons.<br>
<br>
In your example, you want to find hex values. I'd rather see a
lognorm<br>
"parser" created for this purpose. I'm afraid if we start with
regular<br>
expressions, we'll end up mixing rules (RE and non-RE) and it
will make<br>
things very confusing. I really like the way lognorm's "masking"
works.<br>
I'd rather not see that break.<br>
<br>
<br>
<br>
On 11/03/2014 07:15 AM, singh.janmejay wrote:<br>
<br>
<br>
We log a warning?<br>
<br>
--<br>
Regards,<br>
Janmejay<br>
<br>
PS: Please blame the typos in this mail on my phone's
uncivilized soft<br>
<br>
keyboard sporting it's not-so-smart-assist technology.<br>
<br>
<br>
<br>
On Nov 3, 2014 5:37 PM, "David Lang" <<a class="moz-txt-link-abbreviated" href="mailto:david@lang.hm">david@lang.hm</a>
<a class="moz-txt-link-rfc2396E" href="mailto:david@lang.hm"><mailto:david@lang.hm></a><br>
<br>
<<a class="moz-txt-link-freetext" href="mailto:david@lang.hm">mailto:david@lang.hm</a> <a class="moz-txt-link-rfc2396E" href="mailto:david@lang.hm"><mailto:david@lang.hm></a>>
<<a class="moz-txt-link-abbreviated" href="mailto:david@lang.hm">david@lang.hm</a> <a class="moz-txt-link-rfc2396E" href="mailto:david@lang.hm"><mailto:david@lang.hm></a>>> wrote:<br>
<br>
<br>
On Mon, 3 Nov 2014, singh.janmejay wrote:<br>
<br>
I am thinking of it as a 2nd class field-type.<br>
<br>
By that I mean, one gets best performance from 1st
class<br>
<br>
supported<br>
<br>
field-types, but if for some reason that is not
sufficient for<br>
<br>
someone,<br>
<br>
they can use a regex-field-type. It may be a little
low on<br>
<br>
performance, but<br>
<br>
then it unblocks people immediately.<br>
<br>
I can do it, just need to know we are not
ideologically against<br>
<br>
it.<br>
<br>
<br>
Kind of construct im thinking of:<br>
<br>
%foo:regex:[a-f0-9]+% to match hex-numbers for
instance.<br>
<br>
Thoughts?<br>
<br>
<br>
Since this will be such a performance pig compared to the
existing<br>
<br>
parse tree, how about requiring a 'enable low performance types'
flag or<br>
something like that to enable it?<br>
<br>
<br>
There needs to be some good indicator that this is a
performance<br>
<br>
problem.<br>
<br>
<br>
David Lang<br>
_______________________________________________<br>
Lognorm mailing list<br>
<a class="moz-txt-link-abbreviated" href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Lognorm@lists.adiscon.com"><mailto:Lognorm@lists.adiscon.com></a>
<<a class="moz-txt-link-freetext" href="mailto:Lognorm@lists.adiscon.com">mailto:Lognorm@lists.adiscon.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Lognorm@lists.adiscon.com"><mailto:Lognorm@lists.adiscon.com></a>><br>
<br>
<<a class="moz-txt-link-abbreviated" href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Lognorm@lists.adiscon.com"><mailto:Lognorm@lists.adiscon.com></a>><br>
<br>
<a class="moz-txt-link-freetext" href="http://lists.adiscon.net/mailman/listinfo/lognorm">http://lists.adiscon.net/mailman/listinfo/lognorm</a>
<a class="moz-txt-link-rfc2396E" href="http://lists.adiscon.net/mailman/listinfo/lognorm"><http://lists.adiscon.net/mailman/listinfo/lognorm></a><br>
<br>
_______________________________________________<br>
Lognorm mailing list<br>
<a class="moz-txt-link-abbreviated" href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Lognorm@lists.adiscon.com"><mailto:Lognorm@lists.adiscon.com></a>
<<a class="moz-txt-link-freetext" href="mailto:Lognorm@lists.adiscon.com">mailto:Lognorm@lists.adiscon.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Lognorm@lists.adiscon.com"><mailto:Lognorm@lists.adiscon.com></a>><br>
<br>
<<a class="moz-txt-link-abbreviated" href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Lognorm@lists.adiscon.com"><mailto:Lognorm@lists.adiscon.com></a>><br>
<br>
<a class="moz-txt-link-freetext" href="http://lists.adiscon.net/mailman/listinfo/lognorm">http://lists.adiscon.net/mailman/listinfo/lognorm</a>
<a class="moz-txt-link-rfc2396E" href="http://lists.adiscon.net/mailman/listinfo/lognorm"><http://lists.adiscon.net/mailman/listinfo/lognorm></a><br>
<br>
<br>
<br>
_______________________________________________<br>
Lognorm mailing list<br>
<a class="moz-txt-link-abbreviated" href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Lognorm@lists.adiscon.com"><mailto:Lognorm@lists.adiscon.com></a><br>
<a class="moz-txt-link-freetext" href="http://lists.adiscon.net/mailman/listinfo/lognorm">http://lists.adiscon.net/mailman/listinfo/lognorm</a>
<a class="moz-txt-link-rfc2396E" href="http://lists.adiscon.net/mailman/listinfo/lognorm"><http://lists.adiscon.net/mailman/listinfo/lognorm></a><br>
<br>
<br>
<br>
</blockquote>
<span style="white-space: pre;">><br>
><br>
>
_______________________________________________<br>
> Lognorm mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Lognorm@lists.adiscon.com"><mailto:Lognorm@lists.adiscon.com></a><br>
>
<a class="moz-txt-link-freetext" href="http://lists.adiscon.net/mailman/listinfo/lognorm">http://lists.adiscon.net/mailman/listinfo/lognorm</a>
<a class="moz-txt-link-rfc2396E" href="http://lists.adiscon.net/mailman/listinfo/lognorm"><http://lists.adiscon.net/mailman/listinfo/lognorm></a><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Lognorm mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Lognorm@lists.adiscon.com"><mailto:Lognorm@lists.adiscon.com></a><br>
> <a class="moz-txt-link-freetext" href="http://lists.adiscon.net/mailman/listinfo/lognorm">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
><br>
> _______________________________________________<br>
> Lognorm mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a>
<a class="moz-txt-link-rfc2396E" href="mailto:Lognorm@lists.adiscon.com"><mailto:Lognorm@lists.adiscon.com></a><br>
> <a class="moz-txt-link-freetext" href="http://lists.adiscon.net/mailman/listinfo/lognorm">http://lists.adiscon.net/mailman/listinfo/lognorm</a><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Lognorm mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a><br>
> <a class="moz-txt-link-freetext" href="http://lists.adiscon.net/mailman/listinfo/lognorm">http://lists.adiscon.net/mailman/listinfo/lognorm</a></span><br>
<br>
<br>
</body>
</html>