Hot-keys on this page

r m x p   toggle line displays

j k   next/prev highlighted chunk

0   (zero) top of page

1   (one) first highlighted chunk

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

from base_filter import BaseFilter 

 

class TableScanFilter(BaseFilter): 

    """ accepts only if the line contains a nscanned:[0-9] nreturned:[0-9] where the ratio of nscanned:nreturned is > 100 and nscanned > 10000 

    """ 

    filterArgs = [ 

        ('--scan', {'action':'store_true', 'help':'only output lines which appear to be table scans (if nscanned>10000 and ratio of nscanned to nreturned>100)'}) 

    ] 

 

    def __init__(self, mlogfilter): 

        BaseFilter.__init__(self, mlogfilter) 

 

        if 'scan' in self.mlogfilter.args: 

            self.active = self.mlogfilter.args['scan'] 

 

    def accept(self, logevent): 

 

        ns = logevent.nscanned 

        nr = logevent.nreturned 

 

        if ns != None and nr != None: 

            if nr == 0: 

                # avoid division by 0 errors 

                nr = 1 

            return (ns > 10000 and ns/nr > 100) 

 

        return False