> Which is the difference between eval and lcall? 'eval' will compile the code before *each* execution. This has the advantage of using match variables and action list variables directly in the code:
action=assign %test mystring; eval %o ( print "%test", "\n" ) For example, the above action list does the following: 1) action list variable %test is set to mystring; 2) the action list variable %test is substituted in the Perl code of 'eval' action, yielding: print "mystring", "\n" 3) the code print "mystring", "\n" is compiled 4) the compiled code is executed However, because of step 3 the 'eval' action is *very* expensive when compared to 'lcall'. With 'lcall', the perl code is just compiled once when SEC reads in rules from its configuration files, and all the invocations of 'lcall' execute already compiled code. Therefore, I would recommend to use 'eval' only when it is going to be executed few times (e.g., for loading Perl modules at SEC startup). hope this helps, risto ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
