Faster rules validation #694
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mstemm
force-pushed
the
faster-rules-validation
branch
from
d96bdcd
to
c580b7f
Compare
poiana
added
dco-signoff: yes
dco-signoff: no
and removed
dco-signoff: no
dco-signoff: yes
labels
mstemm
force-pushed
the
faster-rules-validation
branch
from
689de25
to
5c54ea2
Compare
Json-related filtercheck fields supported indexing with brackets, but when looking at the field descriptions you couldn't tell if a field allowed an index, required an index, or did not allow an index. This information was available, but it was a part of the protected aliases map within the class. Move this to the public field information so it can be used outside the class. Also add m_ prefixes for member names, now that the struct isn't trivial. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
Instead of iterating over the entire list of filters and doing pattern matches against each defined filter, perform table lookups. For filters that take arguments e.g. proc.aname[3] or evt.arg.xxx, split the filtercheck string on bracket/dot and check the values against a table. There are now two tables of defined filters: defined_arg_filters and defined_noarg_filters. Each filter is put into a table depending on whether the filter takes an argument or not. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
We shouldn't need to clean up strings via a cleanup function and don't need to do it via a bunch of string.gsub() functions. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This is faster than iteration + string case changes. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
To speed up list expansion, instead of using regexes to replace a list name with its contents, do string searches followed by examining the preceding/following characters for the proper delimiter. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
mstemm
force-pushed
the
faster-rules-validation
branch
from
5c54ea2
to
9e7b59e
Compare
|
LGTM label has been added. Git tree hash: 10e776a4a8ddeb7de69bfe2d5969c90f2ad4eb6f
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: leodido The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
I'm going to merge this, as it has a lgtm and travis passed. I don't know why tide says the tests have not passed, though. |
|
@mstemm travis-ci.com has a bug and does not report back the status to github in a correct way. So, once we have all green and lgtm we just merge. When we will switch to the new CI @markyjackson-taulia is working on PRs will be automatically merged as before. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area engine
What this PR does / why we need it:
Improve rule loading performance by optimizing lua parsing paths to avoid expensive pattern matches.
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Does this PR introduce a user-facing change?: