Re: [syslog-ng]position dependencie of rules and "flags(final);"

19 Mar 2002

      Am Tue, 19 Mar 2002 12:14:57 +0100 schrieben Sie (Balazs Scheidler <bazsi@balabit.hu>):
...
On Fri, Mar 15, 2002 at 02:52:38AM +0100, Volker Apelt wrote:
...
Hello,
Are syslog rules position dependend?
Is "flags(final);" position dependend?
when a final flag is encountered, processing of log statements is ended.
so it is position independent.
So, example1 and 2 are expected to produce different or equal results?

Is syslog-ng internally implemented as:

// code#1   
while(1){
       msg=get a message;  
       for(int i=0;i<list_of_rules.count(); ++i){
            if( match(rule[i], msg) ){
                action of rule[i] ;
                if(is_final(rule[i]))  break;
            }       
       }
}

or as 

// code#2
while(1){
       msg=get a message;  
       done = 0;
       // scann all rules with flag(final) first 
       for(int i=0;i<list_of_rules.count(); ++i){
            if(is_final(rule[i]) && match(rule[i], msg) ){
                action of rule[i];
                done = 1;
                break;
            }       
       }
       // look for matching non-final rules if not yet done
       if( ! done) 
       for(int i=0; i<list_of_rules.count(); ++i){
            if( !is_final(rule[i]) && match(rule[i], msg) ){
                action of rule[i];
            }       
       }
}

Or is the list of rules sorted by flags? 
So, that code #1 with that sorted rule list has the same effect as code#2
with an unsorted list?

--
Volker Apelt   volker_apelt  .@.  yahoo.de (remove the dots, please)   
Dipl. Chem.    +49 6172 31126