[syslog-ng] Using macro substring as another macro

Balazs Scheidler bazsi at balabit.hu
Fri Apr 8 00:51:23 CEST 2011


On Thu, 2011-04-07 at 15:01 +0200, Jakub Jankowski wrote:
> Hi,
> 
> I'd like to implement simple hashing in file() destination, mainly to avoid 
> ext3 32k directories limit, but also for convenience. Is it possible to do 
> something simliar what this shell snippet does:
> 
> $ NAME=value
> $ echo ${NAME[*]:0:1}
> v
> $
> 
> but for macros (especially those coming from parsers)?
> 
> What I want is logs written to /var/log/h/ho/hos/hostname/service.log (with 
> configurable level of subdirs) using a single destination().

There was a similar patch for IP addresses recently, which I haven't had
the time to integrate properly, which created directories over IP
address bytes (e.g. 10.0.0.1 would become 10/0/0/1) although that is
more difficult to do with substring like functionality.

hmm.... thinking out loud. there are basically two syntactic options:

1) to use the new template function syntax

2) to continue extending our bash-like expansion syntax.

The 1) option would be something like:

$(cut -c 1-10 $NAME)

or

$(substr $NAME 1 10)

The alternative would be to add really simple functions as an addition
to the basic template syntax. We currently have the "default" values
like this way:

${NAME:-default}

this results in "default" if $NAME is not-defined or empty.

The template function stuff is easier to write (as you can write plugins
for that, and there's a whole framework to support it). The bash
syntax-like stuff is more difficult to write as the template parser is
manually coded, and each expansion mode has to be open-coded, although
it has better performance (since we can avoid a copy of $NAME into a
temporary buffer).

I'm somewhat undecided. What do others think? Can you also propose a
syntax for 1) above? I wouldn't copy the bash case exactly, as that is
an array operator if I'm right, and syslog-ng doesn't (yet) support
arrays in name-value pairs.

-- 
Bazsi



More information about the syslog-ng mailing list