IETF Logo Mail Archive

Re: [Json] JSON Sequence support for log files

Nico Williams <nico@cryptonector.com> Thu, 08 May 2014 22:13 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: json@ietfa.amsl.com
Delivered-To: json@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D81E1A0176 for <json@ietfa.amsl.com>; Thu, 8 May 2014 15:13:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.044
X-Spam-Level:
X-Spam-Status: No, score=-1.044 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, IP_NOT_FRIENDLY=0.334] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id odozAO_MTH0O for <json@ietfa.amsl.com>; Thu, 8 May 2014 15:13:29 -0700 (PDT)
Received: from homiemail-a27.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) by ietfa.amsl.com (Postfix) with ESMTP id 88CB51A0173 for <json@ietf.org>; Thu, 8 May 2014 15:13:29 -0700 (PDT)
Received: from homiemail-a27.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a27.g.dreamhost.com (Postfix) with ESMTP id 0C78E59805F for <json@ietf.org>; Thu, 8 May 2014 15:13:25 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h= mime-version:in-reply-to:references:date:message-id:subject:from :to:cc:content-type; s=cryptonector.com; bh=xn59vnu4k6Os904fKlMq gUyfFcs=; b=Xz64eNeoShKH3EYdEGjQE1JESgmMwvanloSav0EHB16ajmQOVLdi AA8Eo5S5CF7jZQ2RO1iYcqqmpqBotybg5W38jFE+Pi+p0Lq2GNqP7a4YL+t/+xtV QyAoAGCVSpY+hGvF/h1hxdT5Lert1WEgAzIgZcWykACNiBuyibn5Q3k=
Received: from mail-we0-f169.google.com (mail-we0-f169.google.com [74.125.82.169]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by homiemail-a27.g.dreamhost.com (Postfix) with ESMTPSA id B4619598058 for <json@ietf.org>; Thu, 8 May 2014 15:13:24 -0700 (PDT)
Received: by mail-we0-f169.google.com with SMTP id u56so3188688wes.14 for <json@ietf.org>; Thu, 08 May 2014 15:13:23 -0700 (PDT)
MIME-Version: 1.0
X-Received: by 10.180.108.147 with SMTP id hk19mr267482wib.42.1399587203498; Thu, 08 May 2014 15:13:23 -0700 (PDT)
Received: by 10.216.29.200 with HTTP; Thu, 8 May 2014 15:13:23 -0700 (PDT)
In-Reply-To: <255B9BB34FB7D647A506DC292726F6E11545BD3247@WSMSG3153V.srv.dir.telstra.com>
References: <CAK3OfOjfr_KP+bu977CY2-8oCqO11fh_wfUDuj3LJ3JVrqCXaQ@mail.gmail.com> <CAMm+Lwh9rQf3h-Nw8fgtrOqyCL+oPXOc0-xBdhma2Aqe=OjipA@mail.gmail.com> <CAK3OfOhv0oUWJZPb11SksxDJ-xK8OghUwBt7Y75kuGgOiGD-EA@mail.gmail.com> <255B9BB34FB7D647A506DC292726F6E11545BD3247@WSMSG3153V.srv.dir.telstra.com>
Date: Thu, 08 May 2014 17:13:23 -0500
Message-ID: <CAK3OfOg3qm7GwuUr3HHdWHQWOx1aULuTpGyi2s+8c1vNiE5=dg@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: "Manger, James" <James.H.Manger@team.telstra.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/json/bKCP5FTuWqwSgjUPt_RIPu2RdDI
Cc: Phillip Hallam-Baker <hallam@gmail.com>, "json@ietf.org" <json@ietf.org>
Subject: Re: [Json] JSON Sequence support for log files
X-BeenThere: json@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "JavaScript Object Notation \(JSON\) WG mailing list" <json.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/json>, <mailto:json-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/json/>
List-Post: <mailto:json@ietf.org>
List-Help: <mailto:json-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/json>, <mailto:json-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 08 May 2014 22:13:30 -0000

On Wed, May 7, 2014 at 8:45 PM, Manger, James
<James.H.Manger@team.telstra.com> wrote:
> Syncing to a boundary in the middle of a JSON sequence or log isn't a good reason for RS. You can sync without RS. I think the following detects a boundary between any JSON values.
>
> ( "}" / "]" / %x22 / "e" / "l" / DIGIT ) *ws NL *ws ( "{" / "[" / %x22 / "t" / "f" / "n" / "-" / DIGIT )

Yes, it does, but it's only guaranteed to find boundaries where the
preceding text is complete.  This means that we need an
optional/recommended heuristic for scanning backwards to find any
valid/complete texts between the truncated/invalid one and any
boundaries found with your rule.  Otherwise one might be able to log a
bogus entry so as to hide the subsequent one!

Still, I like it.  I'll be submitting -01 soon.

Nico
--

v2.23.0 | Report a Bug | By Email