tyler.durden/loganalyzer
1
0
Fork 0
mirror of https://github.com/rsyslog/loganalyzer.git synced 2025-09-26 03:09:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added support for FULL and PARTIAL String search by prepending a = into the search.

Browse Source 
Also improved the search functionallety within the logstream sources.
Include and Exclude does now correctly work for string filters in the diskfile source.
PDO and MYSQL Logstream work faster now on string filtering when
Full String filter is used, for example when you filter by host.
This commit is contained in:
Andre Lorbach 2008-08-05 14:26:08 +02:00
parent d9abe61068
commit 40ad2c5fa2
6 changed files with 97 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
src/classes/logstream.class.php
View File

@ -493,25 +493,38 @@ abstract class LogStream {
*/
private function SetFilterIncludeMode(&$szValue)
{
// Set Filtermode
// Init BIT!
$myBits = FILTER_MODE_INCLUDE;
// If Filter is Included
$pos = strpos($szValue, "+");
if ( $pos !== false && $pos == 0 )
{
//trunscate +
$szValue = substr( $szValue, 1);
return FILTER_MODE_INCLUDE;
$myBits = FILTER_MODE_INCLUDE;
}
// If Filter is Excluded
$pos = strpos($szValue, "-");
if ( $pos !== false && $pos == 0 )
{
//trunscate -
$szValue = substr( $szValue, 1);
return FILTER_MODE_EXCLUDE;
$myBits = FILTER_MODE_EXCLUDE;
}
// Default is include which means +
return FILTER_MODE_INCLUDE;
// If Filter is a FULL text match!
$pos = strpos($szValue, "=");
if ( $pos !== false && $pos == 0 )
{
//trunscate -
$szValue = substr( $szValue, 1);
$myBits |= FILTER_MODE_SEARCHFULL;
}
// return result
return $myBits;
}
/*

27
src/classes/logstreamdb.class.php
View File

@ -522,25 +522,40 @@ class LogStreamDB extends LogStream {
switch( $myfilter[FILTER_TYPE] )
{
case FILTER_TYPE_STRING:
// Check if user wants to include or exclude!
if ( $myfilter[FILTER_MODE] == FILTER_MODE_INCLUDE)
// --- Check if user wants to include or exclude!
if ( $myfilter[FILTER_MODE] & FILTER_MODE_INCLUDE)
$addnod = "";
else
$addnod = " NOT";
// ---
// If Syslog message, we have AND handling, otherwise OR!
// --- Either make a LIKE or a equal query!
if ( $myfilter[FILTER_MODE] & FILTER_MODE_SEARCHFULL )
{
$szSearchBegin = " = '";
$szSearchEnd = "' ";
}
else
{
$szSearchBegin = " LIKE '%";
$szSearchEnd = "%' ";
}
// ---
// --- If Syslog message, we have AND handling, otherwise OR!
if ( $propertyname == SYSLOG_MESSAGE )
$addor = " AND ";
else
$addor = " OR ";
// ---
// Not create LIKE Filters
// Now Create LIKE Filters
if ( isset($tmpfilters[$propertyname]) )
$tmpfilters[$propertyname][FILTER_VALUE] .= $addor . $dbmapping[$szTableType][$propertyname] . $addnod . " LIKE '%" . $myfilter[FILTER_VALUE] . "%'";
$tmpfilters[$propertyname][FILTER_VALUE] .= $addor . $dbmapping[$szTableType][$propertyname] . $addnod . $szSearchBegin . $myfilter[FILTER_VALUE] . $szSearchEnd;
else
{
$tmpfilters[$propertyname][FILTER_TYPE] = FILTER_TYPE_STRING;
$tmpfilters[$propertyname][FILTER_VALUE] = $dbmapping[$szTableType][$propertyname] . $addnod . " LIKE '%" . $myfilter[FILTER_VALUE] . "%'";
$tmpfilters[$propertyname][FILTER_VALUE] = $dbmapping[$szTableType][$propertyname] . $addnod . $szSearchBegin . $myfilter[FILTER_VALUE] . $szSearchEnd;
}
break;
case FILTER_TYPE_NUMBER:

35
src/classes/logstreamdisk.class.php
View File

@ -633,13 +633,13 @@ class LogStreamDisk extends LogStream {
if ( $propertyname == SYSLOG_MESSAGE )
{
// Include Filter
if ( $myfilter[FILTER_MODE] == FILTER_MODE_INCLUDE )
if ( $myfilter[FILTER_MODE] & FILTER_MODE_INCLUDE )
{
if ( stripos($propertyvalue, $myfilter[FILTER_VALUE]) === false )
$bEval = false;
}
// Exclude Filter
else if ( $myfilter[FILTER_MODE] == FILTER_MODE_EXCLUDE )
else if ( $myfilter[FILTER_MODE] & FILTER_MODE_EXCLUDE )
{
if ( stripos($propertyvalue, $myfilter[FILTER_VALUE]) !== false )
$bEval = false;
@ -649,8 +649,35 @@ class LogStreamDisk extends LogStream {
else
{
$bIsOrFilter = true; // Set isOrFilter to true
if ( stripos($propertyvalue, $myfilter[FILTER_VALUE]) !== false )
$bOrFilter = true;
// Include Filter
if ( $myfilter[FILTER_MODE] & FILTER_MODE_INCLUDE )
{
if ( $myfilter[FILTER_MODE] & FILTER_MODE_SEARCHFULL )
{
if ( strtolower($propertyvalue) == strtolower($myfilter[FILTER_VALUE]) )
$bOrFilter = true;
}
else
{
if ( stripos($propertyvalue, $myfilter[FILTER_VALUE]) !== false )
$bOrFilter = true;
}
}
// Exclude Filter
else if ( $myfilter[FILTER_MODE] & FILTER_MODE_EXCLUDE )
{
if ( $myfilter[FILTER_MODE] & FILTER_MODE_SEARCHFULL )
{
if ( strtolower($propertyvalue) != strtolower($myfilter[FILTER_VALUE]) )
$bOrFilter = true;
}
else
{
if ( stripos($propertyvalue, $myfilter[FILTER_VALUE]) === false )
$bOrFilter = true;
}
}
break;
}
break;

25
src/classes/logstreampdo.class.php
View File

@ -530,25 +530,40 @@ class LogStreamPDO extends LogStream {
switch( $myfilter[FILTER_TYPE] )
{
case FILTER_TYPE_STRING:
// Check if user wants to include or exclude!
if ( $myfilter[FILTER_MODE] == FILTER_MODE_INCLUDE)
// --- Check if user wants to include or exclude!
if ( $myfilter[FILTER_MODE] & FILTER_MODE_INCLUDE)
$addnod = "";
else
$addnod = " NOT";
// ---
// If Syslog message, we have AND handling, otherwise OR!
// --- Either make a LIKE or a equal query!
if ( $myfilter[FILTER_MODE] & FILTER_MODE_SEARCHFULL )
{
$szSearchBegin = " = '";
$szSearchEnd = "' ";
}
else
{
$szSearchBegin = " LIKE '%";
$szSearchEnd = "%' ";
}
// ---
// --- If Syslog message, we have AND handling, otherwise OR!
if ( $propertyname == SYSLOG_MESSAGE )
$addor = " AND ";
else
$addor = " OR ";
// ---
// Not create LIKE Filters
if ( isset($tmpfilters[$propertyname]) )
$tmpfilters[$propertyname][FILTER_VALUE] .= $addor . $dbmapping[$szTableType][$propertyname] . $addnod . " LIKE '%" . $myfilter[FILTER_VALUE] . "%'";
$tmpfilters[$propertyname][FILTER_VALUE] .= $addor . $dbmapping[$szTableType][$propertyname] . $addnod . $szSearchBegin . $myfilter[FILTER_VALUE] . $szSearchEnd;
else
{
$tmpfilters[$propertyname][FILTER_TYPE] = FILTER_TYPE_STRING;
$tmpfilters[$propertyname][FILTER_VALUE] = $dbmapping[$szTableType][$propertyname] . $addnod . " LIKE '%" . $myfilter[FILTER_VALUE] . "%'";
$tmpfilters[$propertyname][FILTER_VALUE] = $dbmapping[$szTableType][$propertyname] . $addnod . $szSearchBegin . $myfilter[FILTER_VALUE] . $szSearchEnd;
}
break;
case FILTER_TYPE_NUMBER:

5
src/include/constants_filters.php
View File

@ -63,8 +63,9 @@ define('FILTER_TYPE', 'filtertype');
define('FILTER_DATEMODENAME', 'datemodename');
define('FILTER_VALUE', 'value');
define('FILTER_MODE', 'filtermode');
define('FILTER_MODE_INCLUDE', 0);
define('FILTER_MODE_EXCLUDE', 1);
define('FILTER_MODE_INCLUDE', 1);
define('FILTER_MODE_EXCLUDE', 2);
define('FILTER_MODE_SEARCHFULL', 4);
// --- Init Facility LIST
$content['filter_facility_list'][] = array( "ID" => SYSLOG_KERN, "DisplayName" => "KERN", "selected" => "" );

8
src/index.php
View File

@ -545,7 +545,7 @@ if ( isset($content['Sources'][$currentSourceID]) )
// Set OnClick Menu for SYSLOG_SYSLOGTAG
$content['syslogmessages'][$counter]['values'][$mycolkey]['hasbuttons'] = true;
$content['syslogmessages'][$counter]['values'][$mycolkey]['buttons'][] = array(
'ButtonUrl' => '?filter=syslogtag%3A' . $logArray[$mycolkey] . '&search=Search' . $content['additional_url_sourceonly'],
'ButtonUrl' => '?filter=syslogtag%3A%3D' . urlencode($logArray[$mycolkey]) . '&search=Search' . $content['additional_url_sourceonly'],
'DisplayName' => $content['LN_VIEW_FILTERFOR'] . "'" . $logArray[$mycolkey] . "'",
'IconSource' => $content['MENU_BULLET_BLUE']
);
@ -560,7 +560,7 @@ if ( isset($content['Sources'][$currentSourceID]) )
// Set OnClick Menu for SYSLOG_HOST
$content['syslogmessages'][$counter]['values'][$mycolkey]['hasbuttons'] = true;
$content['syslogmessages'][$counter]['values'][$mycolkey]['buttons'][] = array(
'ButtonUrl' => '?filter=source%3A' . $logArray[$mycolkey] . '&search=Search' . $content['additional_url_sourceonly'],
'ButtonUrl' => '?filter=source%3A%3D' . urlencode($logArray[$mycolkey]) . '&search=Search' . $content['additional_url_sourceonly'],
'DisplayName' => $content['LN_VIEW_FILTERFOR'] . "'" . $logArray[$mycolkey] . "'",
'IconSource' => $content['MENU_BULLET_BLUE']
);
@ -571,7 +571,7 @@ if ( isset($content['Sources'][$currentSourceID]) )
// Set OnClick Menu for SYSLOG_EVENT_LOGTYPE
$content['syslogmessages'][$counter]['values'][$mycolkey]['hasbuttons'] = true;
$content['syslogmessages'][$counter]['values'][$mycolkey]['buttons'][] = array(
'ButtonUrl' => '?filter=eventlogtype%3A' . $logArray[$mycolkey] . '&search=Search' . $content['additional_url_sourceonly'],
'ButtonUrl' => '?filter=eventlogtype%3A%3D' . urlencode($logArray[$mycolkey]) . '&search=Search' . $content['additional_url_sourceonly'],
'DisplayName' => $content['LN_VIEW_FILTERFOR'] . "'" . $logArray[$mycolkey] . "'",
'IconSource' => $content['MENU_BULLET_BLUE']
);
@ -586,7 +586,7 @@ if ( isset($content['Sources'][$currentSourceID]) )
// Set OnClick Menu for SYSLOG_EVENT_SOURCE
$content['syslogmessages'][$counter]['values'][$mycolkey]['hasbuttons'] = true;
$content['syslogmessages'][$counter]['values'][$mycolkey]['buttons'][] = array(
'ButtonUrl' => '?filter=eventlogsource%3A' . $logArray[$mycolkey] . '&search=Search' . $content['additional_url_sourceonly'],
'ButtonUrl' => '?filter=eventlogsource%3A%3D' . urlencode($logArray[$mycolkey]) . '&search=Search' . $content['additional_url_sourceonly'],
'DisplayName' => $content['LN_VIEW_FILTERFOR'] . "'" . $logArray[$mycolkey] . "'",
'IconSource' => $content['MENU_BULLET_BLUE']
);