-
Notifications
You must be signed in to change notification settings - Fork 64
/
compatibility-v2
36 lines (32 loc) · 1.68 KB
/
compatibility-v2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
- the lognormalizer tool now defaults to json output format
- API changes
* ln_loadSample() does no longer exist
loading of samples at runtime is no longer possible. This is due to
the fact that the parse DAG is compiled into the most efficient form
and thereafter read-only. If urgently needed, we could change the code
so that the unoptimized form is kept (memory intense) and a re-compile
happens after each addition (time intense).
- the plain old iptables parser is no longer supported. Sorry for that,
but keeping it would have caused violation of layers. It can be
replaced by the new one
- the rulebase format for v2 has changed to support the enhancements
It is mostly compatible with v1, which means it understands mosts of
it's constructs. However, some are NOT understood:
- the "tokenized" parser is no longer supported. Use the more
capable "repeat" parser instead.
- the "recursive" and "descent" parsers are no longer supported. Use
user-defined data types instead.
- the suffixed parser and friends are no longer supported. A
replacement is currently being developed.
- the regexp parser is no longer supported and needs to be
replaced by other liblognorm features
for details on this decision see:
https://github.com/rsyslog/liblognorm/issues/143
To signify that a rule base file contains v2 format, it must contain
the line
version=2
as the very first line of the file, in exactly this format (no comments,
no whitespace, nothing else in between the words or after them). If that
line is missing or not given **exactly** as above, the old v1 engine is
used, with all of its restrictions. If it is present, the v2 engine is
used.