From 7fd25c33186a12ee1e9b855dc7cc33b0cf9a3ad3 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Mon, 26 Sep 2005 13:56:21 +0000 Subject: added the "startwith" property-filter comparison operation --- NEWS | 4 +++- doc/bugs.html | 10 +++------- stringbuf.c | 31 +++++++++++++++++++++++++++++++ stringbuf.h | 1 + syslogd.c | 15 ++++++++++++--- 5 files changed, 50 insertions(+), 11 deletions(-) diff --git a/NEWS b/NEWS index 7e0bd578..652fcc27 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,8 @@ --------------------------------------------------------------------------- Version 1.10.2 (RGer), 2005-09-2? -- added the "isequal" comparison operation in property-based filters +- added comparison operations in property-based filters: + * isequal + * startswith - added ability to negate all property-based filter comparison oprations by adding a !-sign right in front of the operation name - fixed a bug that caused rsyslogd to dump core when the compare value diff --git a/doc/bugs.html b/doc/bugs.html index 7c3b8061..f3592b0c 100644 --- a/doc/bugs.html +++ b/doc/bugs.html @@ -11,14 +11,10 @@ bug tracker at sourceforge.net. This list here contains more architectural things while the bug tracker most often lists things that you will actually experience. I am working to combine the two lists, but for now you need to visit both.

-

This list has last been updated on 2005-09-20 by +

This list has last been updated on 2005-09-26 by Rainer Gerhards.

rsyslogd

-

Property-Based Filters

-

If you forget to specify the quotes around "value" in a property-based filter, -rsyslogd segfaults immediately upon startup. Due to be fixed soon.

-

REPEATED LOG LINES -

+

REPEATED LOG LINES

If multiple log lines with the exact same content are received, the duplicates are NOT suppressed. This is done by sysklogd in all cases. We plan to add this as an optional feature, @@ -63,4 +59,4 @@ names...).

instances does not work. Use TCP instead.

- \ No newline at end of file + diff --git a/stringbuf.c b/stringbuf.c index 1f6d6316..738a1f81 100755 --- a/stringbuf.c +++ b/stringbuf.c @@ -371,6 +371,37 @@ int rsCStrCStrCmp(rsCStrObj *pCS1, rsCStrObj *pCS2) } +/* check if a CStr object starts with a sz-type string. This function + * is initially written to support the "startswith" property-filter + * comparison operation. Maybe it also has other needs. + * rgerhards 2005-09-26 + */ +int rsCStrStartsWithSzStr(rsCStrObj *pCS1, char *psz, int iLenSz) +{ + rsCHECKVALIDOBJECT(pCS1, OIDrsCStr); + assert(psz != NULL); + assert(iLenSz == strlen(psz)); /* just make sure during debugging! */ + if(pCS1->iStrLen >= iLenSz) { + /* we are using iLenSz below, because we need to check + * iLenSz characters at maximum (start with!) + */ + if(iLenSz == 0) + return 0; /* yes, it starts with a zero-sized string ;) */ + else { /* we now have something to compare, so let's do it... */ + register int i; + for(i = 0 ; i < iLenSz ; ++i) { + if(pCS1->pBuf[i] != psz[i]) + return pCS1->pBuf[i] - psz[i]; + } + /* if we arrive here, the string actually starts with psz */ + return 0; + } + } + else + return -1; /* pCS1 is less then psz */ +} + + /* compare a rsCStr object with a classical sz string. This function * is almost identical to rsCStrZsStrCmp(), but it also takes an offset * to the CStr object from where the comparison is to start. diff --git a/stringbuf.h b/stringbuf.h index a5e99392..66288bce 100755 --- a/stringbuf.h +++ b/stringbuf.h @@ -107,6 +107,7 @@ int rsCStrSzStrCmp(rsCStrObj *pCS1, char *psz, int iLenSz); int rsCStrOffsetSzStrCmp(rsCStrObj *pCS1, int iOffset, char *psz, int iLenSz); int rsCStrLocateSzStr(rsCStrObj *pCStr, char *sz); int rsCStrLocateInSzStr(rsCStrObj *pThis, char *sz); +int rsCStrStartsWithSzStr(rsCStrObj *pCS1, char *psz, int iLenSz); /* now come inline-like functions */ #ifdef NDEBUG diff --git a/syslogd.c b/syslogd.c index 02cd5b54..d8ebd28e 100644 --- a/syslogd.c +++ b/syslogd.c @@ -488,6 +488,7 @@ struct filed { FIOP_NOP = 0, /* do not use - No Operation */ FIOP_CONTAINS = 1, /* contains string? */ FIOP_ISEQUAL = 2, /* is (exactly) equal? */ + FIOP_STARTSWITH = 3 /* starts with a string? */ } operation; rsCStrObj *pCSCompValue; /* value to "compare" against */ char isNegated; /* actually a boolean ;) */ @@ -3326,6 +3327,10 @@ int shouldProcessThisMessage(struct filed *f, struct msg *pMsg) if(rsCStrSzStrCmp(f->f_filterData.prop.pCSCompValue, pszPropVal, strlen(pszPropVal)) == 0) iRet = 1; /* process message! */ + } else if(f->f_filterData.prop.operation == FIOP_STARTSWITH) { + if(rsCStrStartsWithSzStr(f->f_filterData.prop.pCSCompValue, + pszPropVal, strlen(pszPropVal)) == 0) + iRet = 1; /* process message! */ } else { /* here, it handles NOP (for performance reasons) */ assert(f->f_filterData.prop.operation == FIOP_NOP); iRet = 1; /* as good as any other default ;) */ @@ -3553,7 +3558,7 @@ void logmsg(int pri, struct msg *pMsg, int flags) * 2005-09-19 rgerhards */ if(!shouldProcessThisMessage(f, pMsg)) { - dprintf("message filter does not match - ignore this selector line\n"); + dprintf("message filter does not match - ignoring selector line\n"); continue; } @@ -4154,7 +4159,7 @@ void fprintlog(register struct filed *f, int flags) case F_TTY: case F_FILE: case F_PIPE: - dprintf("(%s)\n", f->f_un.f_fname); + dprintf(" (%s)\n", f->f_un.f_fname); /* TODO: check if we need f->f_time = now;*/ /* f->f_file == -1 is an indicator that the we couldn't open the file at startup. */ @@ -4973,6 +4978,8 @@ void init() printf("'contains'"); else if(f->f_filterData.prop.operation == FIOP_ISEQUAL) printf("'isequal'"); + else if(f->f_filterData.prop.operation == FIOP_STARTSWITH) + printf("'startswith'"); else printf("'ERROR - invalid filter type!'"); printf("\n"); @@ -5491,6 +5498,8 @@ rsRetVal cflineProcessPropFilter(char **pline, register struct filed *f) f->f_filterData.prop.operation = FIOP_CONTAINS; } else if(!rsCStrOffsetSzStrCmp(pCSCompOp, iOffset, "isequal", 7)) { f->f_filterData.prop.operation = FIOP_ISEQUAL; + } else if(!rsCStrOffsetSzStrCmp(pCSCompOp, iOffset, "startswith", 10)) { + f->f_filterData.prop.operation = FIOP_STARTSWITH; } else { logerrorSz("error: invalid compare operation '%s' - ignoring selector", rsCStrGetSzStr(pCSCompOp)); @@ -5749,7 +5758,7 @@ rsRetVal cfline(char *line, register struct filed *f) break; case '~': /* rgerhards 2005-09-09: added support for discard */ - dprintf ("discard"); + dprintf ("discard\n"); f->f_type = F_DISCARD; break; -- cgit