Alright, take a look. Defaults to using timestamps unless explicitly told 'timestamps: false', even if timestamps is not present. Won't step on anyone's toes!<div><br></div><div>Xavier<br><br><div class="gmail_quote">
On Mon, Jul 12, 2010 at 7:34 AM, Victor Julien <span dir="ltr"><<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Basically you do the changes in a local branch, commit them and run the<br>
command "git format-patch -N" where N is the number of commits you have<br>
done. So if you did all changes in one commit "git format-patch -1".<br>
This gets you a patch file that you can send to me :)<br>
<div><br>
Xavier Lange wrote:<br>
> Great! Now I've used the instructions from doc/GITGUIDE and I created my<br>
> branch and merged back in to master. How do I get these changes out to you?<br>
><br>
> Xavier<br>
><br>
> On Fri, Jul 9, 2010 at 2:18 PM, Victor Julien <<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a><br>
</div><div>> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>>> wrote:<br>
><br>
</div><div>> Xavier Lange wrote:<br>
> > Whoops, forgot to cc this on the list...<br>
> ><br>
> > On Fri, Jul 9, 2010 at 1:18 PM, Xavier Lange <<a href="mailto:xrlange@gmail.com" target="_blank">xrlange@gmail.com</a><br>
> <mailto:<a href="mailto:xrlange@gmail.com" target="_blank">xrlange@gmail.com</a>><br>
</div><div>> > <mailto:<a href="mailto:xrlange@gmail.com" target="_blank">xrlange@gmail.com</a> <mailto:<a href="mailto:xrlange@gmail.com" target="_blank">xrlange@gmail.com</a>>>> wrote:<br>
> ><br>
> > Reason for suppression: I'm writing to a fifo for easy ipc.<br>
> I've got<br>
> > my own barnyard-esque app and given my constraints it's easier to<br>
> > use a fifo (it has some properties I prefer). Snort had this<br>
> feature<br>
> > in its log config so I thought it would handy here as well.<br>
> ><br>
> > Out of curiosity, any reason to avoid adding the field to a<br>
> threadvar?<br>
><br>
> Basically the different logging modules are each separate modules. I'd<br>
> like each module to be as separated from the others as possible. We have<br>
> a bunch of logging/output modules what don't use the timestamp: fast,<br>
> alert-debuglog, prelude.<br>
><br>
> Cheers,<br>
> Victor<br>
><br>
> ><br>
> > Xavier<br>
> ><br>
> ><br>
> > On Fri, Jul 9, 2010 at 12:48 PM, Victor Julien<br>
> <<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>><br>
</div><div><div></div><div>> > <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>>>> wrote:<br>
> ><br>
> > I guess my first question would be "what do you need to<br>
> suppress<br>
> > it for?"<br>
> ><br>
> > Xavier Lange wrote:<br>
> > > What behavior would people like if you're suppressing<br>
> the unified2<br>
> > > timestamp field? I'm hacking up some changes to suppress the<br>
> > timestamp<br>
> > > and I've got two options:<br>
> > ><br>
> > > a) Reset the file when the limit is hit<br>
> > > b) Ignore the file limit and just keep writing<br>
> > ><br>
> > > I think a is the better choice is a because the user has<br>
> > specified the<br>
> > > file size limit in their config. Either behavior is fine<br>
> by me.<br>
> > ><br>
> > > Here's the config I'm envisioning:<br>
> > > - unified2-alert:<br>
> > > enabled: yes<br>
> > > filename: unified2.alert<br>
> > > timestamp: false<br>
> > ><br>
> > > And just have it keep writing to a file (in my case I'm<br>
> > writing to a<br>
> > > fifo for ez IPC).<br>
> > ><br>
> > > The code I'm looking at changing:<br>
> > > * tm-modules.h<br>
> > > * Add (int) suppress_timestamp to LogFileCtx_.<br>
> ><br>
> > I don't think this chance is necessary. You can get a new<br>
> option for<br>
> > just unified2 in Unified2AlertInitCtx.<br>
> ><br>
> > > * Or come up with a convention where non-null filename and<br>
> > null prefix<br>
> > > imply suppression of timestamp.<br>
> > > * Unified2AlertInitCtx<br>
> > > * Inspect ConfNode to detect presence and value of<br>
> > "timestamp", alter<br>
> > > file_ctx accordingly<br>
> ><br>
> > In Unified2AlertOpenFileCtx you could check for the option<br>
> as it was<br>
> > retrieved by Unified2AlertInitCtx. The option can just be<br>
> saved to a<br>
> > local static variable.<br>
> ><br>
> > Cheers,<br>
> > Victor<br>
> ><br>
> > > * Unified2<br>
> > > * Check suppress_timestamp or the convention, and then<br>
> implement<br>
> > > strategy a) or b).<br>
> > ><br>
> > > Ideas? Feedback?<br>
> > ><br>
> > ><br>
> > ><br>
> ><br>
> ------------------------------------------------------------------------<br>
> > ><br>
> > > _______________________________________________<br>
> > > Oisf-devel mailing list<br>
> > > <a href="mailto:Oisf-devel@openinfosecfoundation.org" target="_blank">Oisf-devel@openinfosecfoundation.org</a><br>
> <mailto:<a href="mailto:Oisf-devel@openinfosecfoundation.org" target="_blank">Oisf-devel@openinfosecfoundation.org</a>><br>
> > <mailto:<a href="mailto:Oisf-devel@openinfosecfoundation.org" target="_blank">Oisf-devel@openinfosecfoundation.org</a><br>
> <mailto:<a href="mailto:Oisf-devel@openinfosecfoundation.org" target="_blank">Oisf-devel@openinfosecfoundation.org</a>>><br>
> > ><br>
> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
> ><br>
> ><br>
> > --<br>
> > ---------------------------------------------<br>
> > Victor Julien<br>
> > <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
> > PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> > ---------------------------------------------<br>
> ><br>
> ><br>
> ><br>
><br>
><br>
> --<br>
> ---------------------------------------------<br>
> Victor Julien<br>
> <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
> PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> ---------------------------------------------<br>
><br>
><br>
<br>
<br>
</div></div>--<br>
<div><div></div><div>---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
</div></div></blockquote></div><br></div>