From 8fbcea483710faae468ecf0ba706adc7e60ed41d Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 9 Jun 2010 15:37:00 +0200 Subject: main msg q consumer now preprocesses messages before doing rule processing things like ACL check and message parsing. This leads to a greater level of concurrent processing. Beware, though, that this commit duplicates some messages. May be a regression from this or an earlier commit. I will soon sort out. --- doc/msgflow.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'doc') diff --git a/doc/msgflow.txt b/doc/msgflow.txt index c1c440ef..b53ba7e7 100644 --- a/doc/msgflow.txt +++ b/doc/msgflow.txt @@ -18,11 +18,11 @@ syslogd.c/msgConsumeOne parser.ParseMsg ruleset.ProcessMsg (loops through ruleset) ruleset.c/processMsgDoRules (for each rule in ruleset) -rule.c/ProcessMsg -rule.c/shouldProcessThisMessage +rule.c/processMsg +1:rule.c/shouldProcessThisMessage (evaluates filters, optimize via ALL-Filter) if to be processed, loop through associated actions -> -rule.c/processMsgsDoAction +2:rule.c/processMsgsDoAction action.c/actionCallAction (LOCKs action object!) action.c/doActionCallAction (does duplicate message reduction) action.c/actionWriteToAction -- cgit