An It-slave in the digital saltmine

10
Mar

Minor release of op5 LogServer 3.4

Posted by peter

Today we release op5 LogServer 3.4, a minor release containing the following features and fixes.

Code refactoring and bug fixes
Possibility to turn on and off full text indexing
Speed and robustness improvements to the query logic

Code refactoring and bug fixes

Over time as a project grows there comes need for refactoring. In this release we have refactored parts of the code to improve stability and maintainability. For example front-end controller design pattern was introduced in this release, which gave us the possibility to both improve security and simplify code. We fixed a possible message sorting issue and merged a couple of packages to simplify maintenance.

Possibility to turn on and off full text indexing

In op5 LogServer a user has 2 options for search in logs: one is the ‘host=test-host’ kind of search and the other is the full-text search – the ‘test-host’ kind of search, i.e. it just searches the whole log message for whatever you type. By default we create an index for full text search, that makes the full text search queries speedier. In some environments full text indexing of log messages are not really a good thing. For example if you have a lot of log messages from a firewall consisting messages that contains a lot of “non words”, binary data dumps and such. Log messages like that can hog your CPU
and affect the responsiveness of the op5 LogServer system.

You can now chose if you want to use full text indexing or not by a configurable setting in the GUI.

Note: If you turn off the full text index, searches using full text search will be slower.

Speed and robustness improvements to the query logic

Every search traverses the database by hour and ask it to return log messages up to the requested amount of matches, i.e. depending on how many messages you have chosen to view on the page. When the result of one hour is returned the query logic determines if it should query the database for another hour and also how many more matches that are required. This
gives us a more precise result.

This also leads us to a number of changes:

“Unlimited search” mode as a special case is deprecated – now all the searches are done across all the DB
The green line in the timeline now shows the time frame where the search was done to find the present results, even covering multiple days.
The user can now stop the search (system will finish the search in current hour still – and then will stop)
The interaction with the database is more clean and a number of possible deadlocks are eliminated.

Installation and Upgrade Notes

Upgrading requires op5 LogServer 3.0 or later. Upgrade is possible either by using yum or by using the .tar.gz install file available at http://www.op5.com/support/.