[syslog-ng] merging stuff from merge-queue/3.4

[Balazs Scheidler]

Hi,

I have started merging the branch $subject, however I've found some
patches I couldn't merge.

system-source: Use follow-freq(1) on FreeBSD prior to 9.1

   Are you sure time based polling would work here? I mean time based
   polling also checks if the size of the file has changed, as it was
   meant to be used only with regular files.

   I'm afraid that the inability to use kqueue on /dev/klog would
   prevent using kqueue completely, as the syslog-ng file source code
   requires either regular files or pollable devices.

dbparser: support inheriting properties in a corellation action

   I merged this one, although I have some doubts. It uses
   log_msg_clone_cow(), which does have some tricky semantics, as it
   assumes that the cloned message will not change, once cloned.

   I was thinking about removing clone_cow() completely because of this
   tricky stuff, and whenever we need a clone we're about to change the
   LogMessage anyway, and delaying the actual change means that we have
   to do two malloc() calls, instead of one.

   Can you test whether changing the message that triggered the action
   with a rewrite rule, keeps the cloned one intact? This would need a
   parallel path to the db-parser().

dbparser: Make the context length available to action conditions

   I didn't pick this one. I was thinking about using a template
   function to return the number of entries in the current context. 

   This patch changes the log message while it could keep it read-only,
   and even if I wanted to do this macro-like, I'd have created a real
   macro. Both template formatting and template functions receive the
   context as arguments anyway, so the required information is readily 
   available.



-- 
Bazsi