> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of [email protected] > Sent: Friday, February 11, 2011 8:02 AM > To: rsyslog-users > Subject: Re: [rsyslog] how can a parser insert data into a message > > On Fri, 11 Feb 2011, Rainer Gerhards wrote: > > > Have a look at ./runtime/parser.c, function SanitizeMsg. It builds a > new > > buffer and uses MsgSetRawMsg to set the new buffer. MsgSetRawMsg > handles the > > "dirty" internals of message object buffer manipulation. > > > > Note that it may be quicker to manipulate the buffer pointers > yourself. But > > then you must be very careful. MsgSetRawMsg should provide the > necessary > > hints. The thing to keep on your mind is that up to a certain message > length, > > a buffer is used from the msg object itself (thus saving one > malloc/free > > call) whereas for larger size messages, memory is allocated. You need > to keep > > that straight during manipulation. > > I'll look at it and see how hard it is to separate these two cases. > thanks > for the pointer here.
Just let me add that I did find it of questionable value to try avoid the malloc here. At least in the sanitization problem, this would have resulted in very complex code. And while saving memory writes and calls to the malloc subsystem is useful, I thought that it would not have brought much benefit in that case. Depending on what you intend to do (well-defined insert at late point) things may be different, though. Rainer > > > As a side-note, it would probably be useful if you could take some > bullet > > points on how to modify things, so that others can find that > information in > > the case they want to do that themselves. Could go to the wiki or I > could > > include it in the doc set. Just a suggestion, though... > > I'll see what I can do. > > David Lang > > > Rainer > > > >> -----Original Message----- > >> From: [email protected] [mailto:rsyslog- > >> [email protected]] On Behalf Of [email protected] > >> Sent: Friday, February 11, 2011 5:38 AM > >> To: rsyslog-users > >> Subject: [rsyslog] how can a parser insert data into a message > >> > >> the various parser modules that I've submitted are all removing data > >> from > >> the log message or overwriting the data in place. > >> > >> But I've now run across a situation where I need to insert > information > >> into the message. I know that this can be done because the > sanitizing > >> call > >> does exactly this. I am assuming that this is doing something like > >> allocating a new string and copying the data into the new string. > >> > >> the concern is how to do this in a way that will survive the exit > from > >> the > >> module, not confuse any of the many pointers or sizes that are > >> involved, > >> and make sure everything is properly freed afterwords. > >> > >> should I just search for the sanitizing routine and copy what it > does > >> (and > >> can you point me at it?), or do you want me to wait until you have > time > >> to > >> write something up on this? > >> > >> David Lang > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
