asl_search

Subject: asl_search
From: Santosh Sinha <email@hidden>
Date: Thu, 2 Jul 2009 21:01:52 +0530

Hi,

I have large volume of log messages in asl. My problem is- it takes long time to search them. Here is the code which I am using to fetch the messages from asl log-

q = asl_new(ASL_TYPE_QUERY);

asl_set_query(q, ASL_KEY_SENDER, "Value", ASL_QUERY_OP_EQUAL);

r = asl_search(NULL, q);

while (NULL != (m = aslresponse_next(r)))

{

for (i = 0; (NULL != (key = asl_key(m, i))); i++)

{

val = asl_get(m, key);

----------

}

I found a asl.conf file to optimize this search process. which says-

  The "store" action saves matching messages in a separate log message database.  The database may be
  accessed using the syslog command line utility.  A database pathname must follow the "store" keyword.
  A new database will be created if one does not exist.  Two optional parameters, "stayopen" and
  "exclude_asldb" may follow the database pathname.

  By default, syslogd will open the database, save a matching message, and then close the database.  If a
  high volume of messages is expected, specifying "stayopen" will improve performance.

  Specifying "exclude_asldb" will cause syslogd to save matching messages in the database, but exclude
  them from the main syslogd database (/var/log/asl.db).

But I don't know how to specify store action in my code or how to use it. Can you help me with some syntax of how to write it in separate log file.

Please help me with some code snippet.

Thanks!

santosh

 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-dev mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:

This email sent to email@hidden

Follow-Ups:
- Re: asl_search
  - From: Marc Majka <email@hidden>
- Re: asl_search
  - From: Steve Checkoway <email@hidden>

Next by Date: Re: asl_search
Next by thread: Re: asl_search
Index(es):
- Date
- Thread