liblognorm-dev 1.1.2-1.1 / usr / share / doc / liblognorm-dev / html / internals.html

This file is indexed.

/usr/share/doc/liblognorm-dev/html/internals.html is in liblognorm-dev 1.1.2-1.1.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below. 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


<html xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    
    <title>Liblognorm internals &mdash; A fast log normalization library</title>
    
    <link rel="stylesheet" href="_static/haiku.css" type="text/css" />
    <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
    
    <script type="text/javascript">
      var DOCUMENTATION_OPTIONS = {
        URL_ROOT:    './',
        VERSION:     '1.1.2',
        COLLAPSE_INDEX: false,
        FILE_SUFFIX: '.html',
        HAS_SOURCE:  true
      };
    </script>
    <script type="text/javascript" src="_static/jquery.js"></script>
    <script type="text/javascript" src="_static/underscore.js"></script>
    <script type="text/javascript" src="_static/doctools.js"></script>
    <link rel="top" title="A fast log normalization library" href="index.html" />
    <link rel="next" title="Licensing" href="license.html" />
    <link rel="prev" title="Library API" href="libraryapi.html" /> 
  </head>
  <body role="document">
      <div class="header" role="banner"><h1 class="heading"><a href="index.html">
          <span>Liblognorm 1.1.2 documentation</span></a></h1>
        <h2 class="heading"><span>Liblognorm internals</span></h2>
      </div>
      <div class="topnav" role="navigation" aria-label="top navigation">
      
        <p>
        «&#160;&#160;<a href="libraryapi.html">Library API</a>
        &#160;&#160;::&#160;&#160;
        <a class="uplink" href="index.html">Contents</a>
        &#160;&#160;::&#160;&#160;
        <a href="license.html">Licensing</a>&#160;&#160;»
        </p>

      </div>
      <div class="content">
        
        
  <div class="section" id="liblognorm-internals">
<h1>Liblognorm internals<a class="headerlink" href="#liblognorm-internals" title="Permalink to this headline"></a></h1>
<div class="section" id="parse-tree">
<h2>Parse-tree<a class="headerlink" href="#parse-tree" title="Permalink to this headline"></a></h2>
<p>A parse-tree is generated each time when normalization process is set up.</p>
<p>You could also call it a optimized rulebase. Each message runs through
this tree consisting of parsers and fields and will be compared to it. The
message can either fit into a branch or not. If it fits, it can be
normalized. If it does not fit any branch in the tree, then a fitting
sample has to be created for this message.</p>
<p>The tree is built from branches. These branches consist of 3 things:
nodes, paths and parser.</p>
<p>A node is typically a literal part from a message where either a parser
follows or there are several subsequent literals which are different, so
one of the paths must be selected. After a parser, a node will always
follow. Parsers are like variables and thus the core structure of a
sample. With these a property field can be filled, which in the end is
needed to normalize the message.</p>
<p>A few notes on optimization of a parse-tree.</p>
<p>A parse-tree is always optimized, whether or not the samples of a similar
kind are next to each other or not. Even if you make the order totally
random, it should always result in the same parse-tree. Therefore, no
optimization efforts have to be made to the tree itself. It reuses
equivalent prefixes of messages which are already in the tree. Only if a
difference occurs, then a new node must follow.</p>
<p>One case where rule order can be significant is when a message can match
two or more different rules. This can occur when the rules differ in
parsers. If in doubt, use <a class="reference internal" href="lognormalizer.html"><em>lognormalizer</em></a> tool to
debug.</p>
</div>
</div>


      </div>
      <div class="bottomnav" role="navigation" aria-label="bottom navigation">
      
        <p>
        «&#160;&#160;<a href="libraryapi.html">Library API</a>
        &#160;&#160;::&#160;&#160;
        <a class="uplink" href="index.html">Contents</a>
        &#160;&#160;::&#160;&#160;
        <a href="license.html">Licensing</a>&#160;&#160;»
        </p>

      </div>

    <div class="footer" role="contentinfo">
      Created using <a href="http://sphinx-doc.org/">Sphinx</a> 1.3.1.
    </div>
  </body>
</html>

APT Browse - Built by Thomas Orozco.