Commit Graph

18 Commits

Author SHA1 Message Date
Henri DF
179e5519ce Small refactoring of output config
This is a step towards being able to support multiple outputs of
different types (including file outputs which require their own config).
2016-04-12 23:21:14 +00:00
Henri DF
d6dee28bbe Output simplification
The Output is now chosen globally (for all rules), on the command line.
2016-03-30 14:27:19 -07:00
Henri DF
97d7b125ba Implicit time in output formats
As pointed out by Loris, timestamping output messages should be a
responsibility of the output/collection system.

So as a first step towards this, add timestamps automatically for output
formats, and remove them from rules.
2016-03-29 19:47:57 -07:00
Henri DF
aea9b0054b Minor error handling improvements 2016-03-29 19:31:34 -07:00
Henri DF
faf36cd8d7 Use new sysdig support for fast processing of in-exprs 2016-03-24 14:25:48 -07:00
Henri DF
aa31d0a0fb Optimization: don't nest at every boolean op 2016-03-18 13:10:07 -07:00
Henri DF
ea158baa8d Fix error string 2016-03-02 22:24:12 +00:00
Henri DF
33ad92e98b Fix typo-bug in lua code 2016-03-01 22:01:45 -08:00
Henri DF
8343d23c3f remove debugging print from rules_loader.lua 2016-03-01 20:10:34 -08:00
Henri DF
6a99c1a978 Basic support for function calls in outputs 2016-02-29 20:15:50 -08:00
Henri DF
1c04ed7874 rework digwatch event output handling
the high-level change is that events matching a rule are now send into a
lua "on_event" function for handling, rather than doing the handling
down in c++.

more specifics:

before, the lua "load_rule" function registered formatters with
associated IDs with the c++ side, which later used this state to
reconcile events with formats and print output accordingly.

now, no such state is kept on the c++ side. the lua "load_rule" function
maintains the id->formatters map, and uses it to print outputs when it
receives events.

this change simplifies the existing flow and will also make the forthcoming
implementation of function outputs far simpler than it would have been
in the current setup.
2016-02-28 21:06:29 -08:00
Henri DF
c695051990 rule_loader.lua: comments cleanups 2016-02-28 23:50:10 +00:00
Henri DF
e725be968e rule_loader.lua: add/improve comments 2016-02-24 08:46:12 -08:00
Henri DF
a3976281a8 Pass rule indices down into filters
This allows to match events back up with the display output they are
associated with.
2016-02-23 18:09:52 +00:00
Henri DF
a7d0132154 Add 'sysdig.set_formatter' and use it in compiler
This allows the compiler to define per-rule formats. They are currently
instantiated and stored on the c++ side, but not being made use of yet.
2016-02-23 18:09:51 +00:00
Henri DF
426097241d Move compiler state and AST grafting to rule_loader.lua
This is needed so that rule_loader (which should be renamed in a later pass..) can tag
filters with their index.
2016-02-22 18:07:54 -08:00
Henri DF
5ba821aaef Fix handling of nested ASTs 2016-02-22 16:26:15 -08:00
Henri DF
c7bafc9a49 Move lua/ to userspace/digwatch 2016-02-21 13:43:08 -08:00