On Mon, 12 Jul 2010, Sean Conner wrote: > It was thus said that the Great Rainer Gerhards once stated: >>> But my overall assumption is that we stick what we currently have, but >>> extend >>> it in a way that provides scoping and do so in a way the provides as >>> many >>> usable interim steps as possible (without adding major work just for >>> those >>> steps). I hope this covers the spirit of our discussion. >> >> I tried very hard the past days to get a grammar together that is an >> evolution from what we currently have. I did not yet succeed fully (thus I >> have no formal grammar to show), but I think I made some progress. >> >> So please let me come back and present a config sample: >> >> http://download.rsyslog.com/rainerscript2_rsyslog.conf >> >> It actually is three configs in one file >> >> a) a standard rsyslog.conf in mixed new and old format >> b) a standard rsyslog.conf in new format, only >> c) a complex rsyslog.conf (not really working) in new format >> >> [partitioned by (just) comments] >> >> Note that being an evolution, any currently existing rsyslog.conf would also >> be a valid new conf (via the *same* parser). I have not thought out the full >> semantics and thousand other things that need to be thought of -- this >> actually opened up a can of worms ;) However, I find the proposed format >> seems to be a good compromise between the need to preserve and the need to >> move on, and between the need for simplicity and the need for power. >> >> As such, before I invest even more time into that format, I'd like to get >> some feedback on what you folks think ;) > > Okay, take number two. > > After reading the various comments about my last message (using > Lua---rejected for various reasons) what it sounds like you want is a more > declaritive syntax---a mapping of input to output. Have you considered a > syntax like Haskel or Erlang? There functions are declared by pattern > matching input parameters and thus, you tend not to see many (if any) if > statements (okay, I checked a sizable Erlang program I have, and it does use > 'case' in a few spots, but not many). > > The original syslog.conf file has what I mean to some degree, with a > syntax like: > > mail.* @maillogprocessinghost > mail.warn /some/log/file > cron.* /some/other/logfile > > Since most of what you want to do is based off the input message, how > about extending this style of syntax to more than just the facility/priority > pair? Since host, program, facility, priority and message are typically the > most interesting fields (at least, in my experience), perhaps a syntax that > includes matching those as well would work. Something like:
<snip> this is the approach that rsyslog took with the old config file. the problem is that we are now getting capibilities that can't easily be represented this way David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
