pmie: making pmie rule print consistent along with or without archive input #1800
Conversation
input There is "print" written while running the pmie rule on archives but it is not there while running the same rule on the live system, this commit makes it consistent for both cases. Signed-off-by: sagar sagar <[email protected]>
There was a problem hiding this comment.
@orasagar I understand sentiment here, but I don't agree with this change.
There is a long discussion over at #1779 on a very similar topic, and I've recently update the man page and docs to explain why "actions" (it is more than just print) are different for live vs archive rule firing.
Without a compelling use case (that I asked for but have not yet received over on #1779) I'd prefer to leave pmie as is.
|
@kmcdonell thanks, for the clarification But I still feel like the action is a different thing but while just reading from the archive shouldn't be different from the live system. |
|
I can understand why you would not want alerts popping up or syslog being updated when you are looking at archive data. Here's my use case: It seems that this functionality exists to troubleshoot what would happen on a live system, but I'm dealing exclusively with archive data. Thanks for your time and consideration. |
|
Thanks @YoderExMachina. If I invoke circa-1970's Unix-thinking, I would suggest that is a better solution that adding another flag to pmie to introduce a small variant in behaviour. We cannot make the existing behaviour go away due to backwards compatilibility goals (who know what scripts an unconditional change in pmie behaviour might break), so we'd have to add some flag or option ... and if I was persuaded to do this it would be much more general that "don't emit print", e.g. -f|--format where is a combination of literal text and the metafield identifiers %a (action), %m (message), %d (ctime date as is), %D (ctime date with sub-second precision), so the current (and default) behaviour would be the same as -f '%a %d %m', and what you want would be -f '%d %m'. Note also that the change as proposed in this PR is not acceptable because it removes the action type for all actions, not just print. |
|
Okay I understand. Will stick with using sed. |
|
@kmcdonell This is off topic and sorry if this isn't kosher, but is there some kind of community forum for PMIE? I'm new to the language and would like to read up on what others have done. |
|
@YoderExMachina I am willing to consider the -f|--format extension if that would really help ... it solves your issue, but also it provides a framework to expose additional information in the future (different date formats, configuration file and line number for the rule that is firing, ...). I'd need some indications from others that this is wothwhile, and then some cycles when this itch gets to the top of my TODO list. As to the pmie "forum", there really isn't one per se. Best options are https://pcp.readthedocs.io/en/latest/QG/AutomatedReasoningBasics.html then the mailing list [email protected] or Slack (join at https://h7zo83mvt1.execute-api.us-west-2.amazonaws.com/Express/) or email directly to me (kenj at kenj.id.au). |
|
@orasagar Kudos for being brave enough to jump into the pmie source, but the change you're suggestion does not really work. Are you OK if I close this PR and move the discussion to a new issue? |
|
@kmcdonell Thanks ,Yeah sounds good to me, Although I have already opened an issue for this and we can continue our discussion there |
|
We're moving the discussion to #1799 and expect a different approach to emerge compared to the changes outlined in this PR. |
There is "print" written while running the pmie rule on archives but it is not there while running the same rule on the live system, this commit makes it consistent for both cases.