You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
after the final DateTimeParseInstr is chosen, any Syslines processed with any other DateTimeParseInstr must be reprocessed (the entire Block would need to be reprocessed). In other words, if any currently stored Sysline was processed using a different DateTimeParseInstr than all of the Syslines must be removed (do not drop them), and then the entire zero Block must be reprocessed for Syslines (luckily, should be fast as the Block and all Lines are still valid). Similar to what is done for reprocessing for missing years. (moved this into Issue block zero analysis needs reprocessing step #74 )
For `find_line_in_block` when no `Line` is found, do return a
"partial" Line to the caller that is the from newline A to
end of the Block.
For `find_sysline_in_block` attempt to match a datetime on that
"partial" Line.
This is to allow matching long lines wihtin a blockzero analysis,
for long lines that extend into the next block (but those functions
will not look at). A "partial" means "looks very likely this
remaining data is a Line or Sysline".
Only used during blockzero analysis.
Issue #22
Problem
A small
--blocksz
, the smallest in release builds is0x40
, may cause failure duringSyslogProcessor::blockzero_analysis_lines
.Solution
Refactor the
blockzero_analysis_lines
approach.The text was updated successfully, but these errors were encountered: