Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reduce some details in the table[pattern] usage note #230

Merged
merged 2 commits into from
Nov 23, 2023
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 11 additions & 12 deletions script-reference/types.rst
Original file line number Diff line number Diff line change
Expand Up @@ -733,7 +733,7 @@ Additional examples:
- ``/foo|bar/i`` matches ``"foo"``, ``"Foo"``, ``"BaR"``, etc.
- ``/foo|(?i:bar)/`` matches ``"foo"`` and ``"BaR"``, but *not* ``"Foo"``.
- ``/"foo"/i`` matches ``"foo"``, but *not* ``"Foo"``.
- ``/foo.bar/`` doesn't matche ``"foo\nbar"``, while ``/foo.bar/s`` does.
- ``/foo.bar/`` doesn't match ``"foo\nbar"``, while ``/foo.bar/s`` does.

The ``i`` and ``s`` modifiers can also be combined in a single pattern
such as ``/foo/is`` or ``/bar/si``. In this case, both case-insensitivity
Expand Down Expand Up @@ -1161,17 +1161,16 @@ as ``/.*foo.*/``.

.. note::

Internally, the individual patterns are matched in parallel using a lazily
constructed determinstic finite automaton (DFA). Depending on the nature of
patterns used within the table *and* the input data used for lookups, this
may result in difficult to predict memory consumption over time.

Users are advised to test scripts using this feature with realistic and
adversarial input data with focus on memory growth. It is possible to
reset the DFA's state by removal or addition of a single pattern. For
observability, the function :zeek:see:`table_pattern_matcher_stats` can
be used. It returns a :zeek:see:`MatcherStats` record with details about
the DFA's state.
Internally, Zeek matches a table's patterns in parallel using a lazily
constructed deterministic finite automaton (DFA). This means that the nature
of patterns in the table *and* the strings looked up in it can lead to
varying degrees of runtime memory growth.

Users are advised to test scripts using this feature with a wide range of
input data. Script developers can reset the DFA's state by removal or
addition of a single pattern. For observability, the
:zeek:see:`table_pattern_matcher_stats` function returns a
:zeek:see:`MatcherStats` record with details about a table's DFA state.


Additional operations
Expand Down