syslog-ng 系列连载-42 ：优化过滤器中的正则表达式

7.6. Optimizing regular expressions in filters

Some filter functions accept regular expressions as parameters. But evaluating general regular expressions puts a high load on the CPU, which can cause problems when the message traffic is very high. Often the regular expression can be replaced with simple filter functions and logical operators. Using simple filters and logical operators, the same effect can be achieved at a much lower CPU load.

# 注释 ：某些过滤器函数接受正则表达式作为参数，但使用正则表达式会增加 CPU 的开销。

# 对于常用的正则表达式，建议使用内置的过滤器函数和布尔操作符来代替，还可以降低 CPU 的开销。

Example 7.3. Optimizing regular expressions in filters

Suppose you need a filter that matches the following error message logged by the xntpd NTP daemon: # 注释 ：例如你想过滤出来自 NTP 服务的日志（xntpd 进程） xntpd[1567]: time error -1159.777379 is too large (set clock manually); The following filter uses regular expressions and matches every instance and variant of this message. # 注释：下面的例子使用 regexp filter f_demo_regexp { program("demo_program") and match("time error .* is too large .* set clock manually"); }; Segmenting the match() part of this filter into separate match() functions greatly improves the performance of the filter. # 注释：但如果改为使用多个 match（）函数也可以达到相同目的 filter f_demo_optimized_regexp { program("demo_program") and match("time error") and match("is too large") and match("set clock manually"); };

---