On Fri, 11 Feb 2011, Rainer Gerhards wrote:
Have a look at ./runtime/parser.c, function SanitizeMsg. It builds a new
buffer and uses MsgSetRawMsg to set the new buffer. MsgSetRawMsg handles the
"dirty" internals of message object buffer manipulation.
Note that it may be quicker to manipulate the buffer pointers yourself. But
then you must be very careful. MsgSetRawMsg should provide the necessary
hints. The thing to keep on your mind is that up to a certain message length,
a buffer is used from the msg object itself (thus saving one malloc/free
call) whereas for larger size messages, memory is allocated. You need to keep
that straight during manipulation.
I'll look at it and see how hard it is to separate these two cases. thanks
for the pointer here.
As a side-note, it would probably be useful if you could take some bullet
points on how to modify things, so that others can find that information in
the case they want to do that themselves. Could go to the wiki or I could
include it in the doc set. Just a suggestion, though...
I'll see what I can do.
David Lang
Rainer
-----Original Message-----
From: [email protected] [mailto:rsyslog-
[email protected]] On Behalf Of [email protected]
Sent: Friday, February 11, 2011 5:38 AM
To: rsyslog-users
Subject: [rsyslog] how can a parser insert data into a message
the various parser modules that I've submitted are all removing data
from
the log message or overwriting the data in place.
But I've now run across a situation where I need to insert information
into the message. I know that this can be done because the sanitizing
call
does exactly this. I am assuming that this is doing something like
allocating a new string and copying the data into the new string.
the concern is how to do this in a way that will survive the exit from
the
module, not confuse any of the many pointers or sizes that are
involved,
and make sure everything is properly freed afterwords.
should I just search for the sanitizing routine and copy what it does
(and
can you point me at it?), or do you want me to wait until you have time
to
write something up on this?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
