Re: regexless parsing, again?
"Mordechai T. Abzug" <[email protected]> Fri, 14 Sep 2007 05:18:55 -0400
| Newsgroups | gmane.comp.sysutils.loganalysis |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Sep 13, 2007 at 06:55:23PM -0400, Marcus J. Ranum wrote: > - Yes, it will use a pseudo-XML like intermediate form. close enough > to XML to annoy those of us who hate XML but incompatible > enough with XML to annoy the XML nazis. > - It will be embeddable as a re-entrant library and should plug into > pretty much anything. > - It will not be syslog-specific. Is the intent to eliminate the need for manual configuration, or just to exchange manual regex configuration for a manual lex+yacc-style setup? If the former, more power to you. If the latter, you may be trading in one kind of tyranny for another kind of tyranny. A lex+yacc setup will still require lots of intervention and expertise. You might get better performance, but you may also run into the limits of LALR(1); logs can need a lot of lookahead. If you put in more lookahead, you'll start running into the same performance problems as regexes. Anyway, looking forward to whatever you come up with! - Morty