Comments (8)
what do you mean difficult to manage?
pdbtool merge?
On Thu, Jul 10, 2014 at 1:08 PM, Tusa Viktor [email protected]
wrote:
We should make debian packages from the
https://github.com/balabit/syslog-ng-patterndb
repo, to be able to distribute it easily. We should also make a link to
this repo from the syslog-ng.org site.Further plans: We should also consolidate them: some files has .pdb
extensions, some
of them has .xml. And they are separated in different files, so it is hard
to load them,
or manage them.—
Reply to this email directly or view it on GitHub
#161.
from syslog-ng.
I mean: If I want to load an ssh pattern, I have to find the file, and then set is a a filename. That's easy so far. But after a month, I want to parse dns logs. Then I create a new xml, and merge these two into them. Then if I want to add newer and newer patterns, I have to constantly merge them into my xml, instead of simply enumerating them, and let patterndb merge it during load time. And when the patterns are updated upstream, after checking out the new version I have to re-merge them again.
from syslog-ng.
I think it is sane to have them in separate files.
Moreover, the Debian package could take care of merging.
What I think more urgent is to normalize the naming scheme. I have an ongoing project at my organization, where this is part of the goals. I started using the patterndbs from github, and did quite a lot of changes and additions. It's a shame that cee project died, but maintaining things in Debian will go into the same direction: if debian users see the same key/values it will start to become "standard" so IMHO it is very important to keep things simple and stable.
I've given many hours ^w days of thought into normalization/categorization and I think I could help in this regard, maybe by sharing my naming scheme with you and having a discussion maybe on IRC or by phone.
What do you think?
from syslog-ng.
My first sentence was a bit miswritten: If I want to load an ssh pattern, I have to find the file, and then set it as a filename in dbparser.
from syslog-ng.
The merging can - and somewhat is - handled on the packaging level. We have update-patterndb
, that merges everything under /etc/syslog-ng/patterndb.d/
into /var/lib/syslog-ng/patterndb.xml
. So if you want to enable a set of rules, just symlink them to that dir, run the script and reload syslog-ng.
It should even be possible to hook up a generator within the syslog-ng config, that does the update & merge every time the config is reloaded.
from syslog-ng.
Regarding a common naming scheme: yes, please! Discussion on the mailing list, or in GitHub PRs or IRC (or anywhere else) would be welcome.
from syslog-ng.
Right, I opened issues on both the patterndb and the website repos, to track the various bits there. Leaving this open here too, in case it turns out that we need changes in syslog-ng itself too.
from syslog-ng.
The one in patterndb has been closed, I think this should be also. (I do not see it happening either way.)
from syslog-ng.
Related Issues (20)
- Unexpected behavior with multiple conditions including 'not' in the filter HOT 4
- There is no problem starting syslog-ng, but Verify reports an error. HOT 1
- OpenTelemetry/OTLP: add support for certificate pinning, like with `trusted-keys()` HOT 3
- Config failing with kafka and template HOT 3
- syslog-ng 3.24.1 sometimes crash in log_pipe_queue HOT 2
- libcloud-auth is underlinked HOT 1
- Fuzzing discovery HOT 1
- Discrepancy in documentation related to how to enable threading for specific sources HOT 5
- Issue using RFC5424 config HOT 17
- Enhance eps_last_1h / eps_last_24h Metrics HOT 2
- Is loki destination actually implemented? HOT 2
- Syslog-ng Service crashes in g_hash_table_lookup function after syslog-ng-ctl reload HOT 2
- `file-reader` supports only polling on linux HOT 2
- destination syslog forget messages on long disconnect/reconnect HOT 4
- modules/affile: NULL deference HOT 1
- lib/cfg-argc.c -- NULL dereference HOT 1
- Multiple issues around the test cases using cmake
- 500 - Internal server error. HOT 2
- Add ${IP} and ${IP_FROM} macros HOT 1
- compiling 4.8.0 on Fedora i686 failed HOT 12
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from syslog-ng.