[INUG-Users] Syslog Rules

[Alex Greenbank]

Hello,

users-bounces at netcoolusers.org wrote on 22/01/2010 02:48:06:
> Hi All,
> 
> Silly question I'm sure but can regexp be used in case and mnemonics in
> the rules files?

No, and the reason is speed.

switch/case with explicit (whole) strings is implemented using a
hash table. Hash the input string, jump to the appropriate hash
bucket and walk the chain performing strcmp to find the exact case then
execute the appropriate code block. Nice and quick.

If it was implemented using regexp you'd have to loop through
every regexp case until you found one that matched. There's no way
to skip the ones that obviously don't match, you need to try each
one. Regexp comparisons can be up to 1000 times slower than a normal
string comparison, a switch statement containing 1000 regexp cases
could take a million times longer to execute than a simple string
switch. (An extreme and contrived scenario but highlights my point).

> For example:
> 
> case "HA|HA-REDCON": ### Cisco High-Availability facility

As someone else has already replied, you can use:-

case "HA" | "HA-REDCON": ### ...

This adds both strings to the hash table pointing to the same block of
rules file code.

Ta,

-alex





Unless stated otherwise above:
IBM United Kingdom Limited - Registered in England and Wales with number 
741598. 
Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6 3AU