--- On Wed, 11/26/08, Ulrik Wieben Rasmussen <[EMAIL PROTECTED]> wrote:
> From: Ulrik Wieben Rasmussen <[EMAIL PROTECTED]>
> Subject: [Simple-evcorr-users] Pattern matching unicode logfiles
> To: "[email protected]"
> <[email protected]>
> Date: Wednesday, November 26, 2008, 10:13 AM
> Hi,
>
> Working on a logfile monitoring project on a Windows 2003
> server with SEC 2.4.2, Cygwin and Perl vers. 5.8.8. The
> logfiles are Unicode UTF-16 files. SEC doesn't seem to
> open these logfiles as utf-16, and as a result, no match in
> the match string is found. Is there something here I have
> missed or? Doesn't seem that others have had this
> problem.
hi,
first of all, I am not really an unicode expert, but after investigating this
issue a bit, it seems that there is no beautiful solution to this problem. The
UTF-encoding can be set with the binmode() function - with SEC-2.4.2, you could
use the following SEC rule for this:
type=single
ptype=regexp
pattern=(SEC_STARTUP|SEC_RESTART|SEC_SOFT_RESTART)
desc=set UTF encoding for inputs
action=eval %o ( \
map { binmode($main::inputsrc{$_}->{"fh"}, ":encoding(utf16)"); } \
keys %main::inputsrc; )
If the -intevents flag is given, this function forces the utf16 encoding for
all open input file handles. There are some caveats, though -- you will see a
lot of warning messages at SEC runtime about functions that have to operate on
malformed utf8 characters; also, when input is reopened, binmode() won't get
called again.
I would prefer to have a way for specifying the UTF16 operation mode via
environment variable, so that sysread(), index() and regexp matching would all
operate seamlessly on input data. Unfortunately, after some research I didn't
find any ways to set it once only (either in command line or sec script file).
So far the only approach that looks more or less sound would be to invoke an
UTF16->ASCII preprocessing script with the 'spawn' action from SEC, and let SEC
to handle its output.
I'd be glad if anyone could suggest an _elegant_ way for tackling the problem.
WBR,
risto
>
> Best Regards
> Ulrik
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move
> Developer's challenge
> Build the coolest Linux based applications with Moblin SDK
> & win great prizes
> Grand prize is a trip for two to an Open Source event
> anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/_______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
