|
Home
News
Packages
Documents
Downloads
Source
License
Contributors
About
Demo
Bug Reports
|
_ _ _ ____
| \ | | | | | \ ( )
| \| | ___ __| | ___| | ) |_ _ __ _ _ _ __
| |/ \ / |/ _ \ <| _|/ | | _ \
| |\ | ( ) | ( | | __/ | ) | | ( | | | | | |
|_| \_|\___/ \__ _|\___|____/|_| \__ _|_|_| |_|
============================================================
NodeBrain 0.9.03 (Columbo) Change Summary
* Released December 14, 2014
* Theme: Reduced Sensitivity to Command Arrival Order
This version provides more flexibility in referencing
nodes before they are defined. It also automatically
resets event attributes to the unknown state when not
specified on an alert, eliminating the need to specify
all event attributes on every alert---required under
prior versions to avoid event attribute values from
impacting rule response to a subsequent alert.
* Packaging:
o The version scheme for the NodeBrain Library (libnb)
has switched to using the Application Binary Interface
version, instead of the release version based scheme
used previously. The release version approach was
intended to require applications to build for every
release, assuming there might be incompatibilities in
every release. The change to an ABI based version is
being made in preparation for a 1.0 release and
subsequent 1.x releases that will not require using
applications to rebuild until release 2.0, except to
gain access to enhancements in a 1.x release.
libnb-0.9.02.so [0.9.02 prior release]
libnb.so.0.0.903 [0.9.03 this release]
libnb.so.1.0.1000 [1.0.00 future release]
o The rpm spec file, and debian packaging files have
been modified to get better build results on various
platforms after the switch from readline to libedit.
The effort to make the project friendly to package
maintainers for various Linux distributions is still
in progress. However, rpmlint is silent on CentOS so
the package will be submit to Fedora for review.
* Documentation:
o The NodeBrain Language manual has been updated to
cover new topics:
- Alert attribute transience
- Node functions
- Cell functions
- Redefine command (new in release 0.9.02)
These topics were not covered previously because their
introduction in the prior releases was experimental.
Because of this, the incompatibilities introduced by
this release for these features are expected to have
little impact.
o The NodeBrain Library manual has been updated with
additional API functions for:
- Access to all terms defined within a node
glossary.
- Registration of simple cell functions.
* Incompatibilities:
o Applications using ALERT commands for both event
and state monitoring may break under this release,
requiring rule changes before upgrading. You will
only have a problem if you depend on some terms
defined within a given node that are set by an ALERT
to the node, retaining their value when subsequent
ALERT commands to the same node do not set a value
for the term. This would mean some of the terms set
by an ALERT are intended to express "state", while
others express an "event". Starting with this
release, you will need to move all terms used to
express "state" within ALERT commands to a different
node. Otherwise, ALERT commands not setting the "state"
terms will automatically cause them to revert to Unknown.
This is not a problem for "state" terms that are set by
all ALERT commands to the node.
define n node;
n. alert a=1,b=2; # a and b may be state or event terms
n. alert a=2,b=3; # No problem because same terms set
n. alert a=3; # Problem if b is intended for "state"
# Prior releases would leave b set to 3
# This release resets b to Unknown
If this is a problem for you, it can be resolved as
follows.
define b cell; # Define state term in different node
define n node;
n. alert a=1,b=2; # a is for "event", b is for "state"
n. alert a=3; # b is not reset to Unknown
o The special syntax for alert attributes has been
dropped after introduction in the prior release. Terms
starting with "@" are now interpreted as node functions
instead of transient alert attributes. We are making
this change now under the assumption that there has
been no significant adoption of either alert attribute
transient terms or node functions.
o The syntax for node functions has changed abruptly under
the assumption that there has been no significant
adoption of this feature after introduction in the
prior release. Node functions were briefly called "facets"
because they are named after the facet of a node that they
manage or access. But it seems more natural to call them
functions that access facets of a node.
Was: node_facet
Now: node@function -or- @function
This freed up "_" for navigation of multiple level
glossaries of terms within a node, and enables function
reference within the context node without repeating
the node term.
* New Features:
o The ALERT command now automatically resets terms defined
directly within the context node to Unknown if set by
the prior ALERT to the node and not the present ALERT.
This eliminates the need to set all event attributes in
every alert to avoid unintended values from prior alerts.
o Node functions can now be referenced within the context
node without specifying the node term.
node@function(arglist) # previously node_facet(argList)
@function(argList) # previously unsupported
o Node functions can now be referenced before a node is
associated with a skill that provides the function. This
enables rules to reference node functions before the node
is defined. This is useful in cases where two nodes
have rules that reference a function of the other.
bill. define r1 on(a) fred@count(a,b)=9;
fred. define r1 on(x) bill@measure(x,y)=27;
After the rule definitions above, "fred" is implicitly
defined to be a node with the "default" skill set.
Since @count is not defined by the default skill, this
function is associated with the unknown skill until the
node is defined explicitly.
define fred node foobar:(a,b);
Once the "fred" node is explicitly defined, the
@count function may be provided by the new skill. If
not, @count will continue to be provided by the
unknown skill.
o A small set of commands, when used as rule actions,
may now be accelerated. You select this option by
using "::" instead of ":" prior to a rule action
command.
define r1 on(a=1 and b=2) x=1::fred. alert y=2;
The commands with acceleration support in
this release are:
alert
assert
system - or =
If you attempt to accelerate other commands, you will
see a warning and the interpreter will revert to
normal as if you had said ":" instead of "::".
This feature is experimental and not yet included
in the NodeBrain Language manual. So it should only
be used to experiment with the performance impact.
o Additional API functions have been included to
simplify access to all terms within a node and
obtain their name, value, and formula.
o The package now includes some API test programs that
are invoked by "make check". This is for build
verification, regression testing, and to provide
some examples for reference that are known to work.
* Deprecated Syntax:
o Built-in math function calls should no longer be
referenced using a syntax that looks like a node
function call. Instead, use the backtick notation
and the qualified name.
assert x=mod(a,16); <== old syntax
assert x=`math.mod(a,16); <== new syntax
Under this version you will get a warning. In a
future release the old syntax will no longer be
recognized. This will eliminate name collisions
with node function calls.
* Dropped Syntax:
o "@" no longer used for alert attribute transient terms.
Transience is now implied within the command context
node.
o "_" no longer used following a node term to reference a
node function. "@" is used instead.
* Bug Fixes:
o Previous versions allowed multiple level term
glossaries with subsequent definition of one of the
intermediate terms as a node. However, IF rules were
associated with a node based on the node hierarchy
existing at time of definition, and did not get moved
when an intermediate term was subsequently define to
be a node. This caused IF rules to respond to alerts
to an unintended node, and not respond to alerts to
the intended node.
This is fixed by preventing a term that is not defined
as a node from being defined as a node, an automatic
creation of nodes when "." navigation is used, and a
recognition of multiple level glossaries when "_"
navigation is used.
o Previous versions allowed nodes to be redefine as
simple cells and other object types. Similar to the
previous defect, this could cause IF rules to be
stranded in a way they could no longer be alerted.
This is fixed by only allowing a node to be redefined
as a node.
o When rules are defined they now properly put a reserve
on the current value of the condition. This was not
done previously, causing unpredictable results under
some patterns of defining and undefining rules.
============================================================
NodeBrain 0.9.02 (Columbo) Change Summary
* Released August 13, 2014
* Theme: Performance, Logic, and License
A primary goal of this version of NodeBrain is to
improve performance for large rule sets with specific
characteristics causing prior versions of NodeBrain
to perform poorly. This is based on theoretical rule
sets, not rule sets of known applications, but the
improvements are real.
A secondary goal is to provide consistency in logic
related to a performance improvement. Basic logical
operators no longer pass all true values through,
converting all true values to a single true value to
avoid unnecessary evaluation of dependent cells. For
other functions that do pass all true value through,
if was decided that special values of true and false
should be provided as separate from all number and
string values, make 0 and 1 both true and not special.
Finally, in support of a change to the MIT License,
dependence on GPL licensed libraries has being removed.
* Documentation:
o True, False and Disabled special value symbols have changed.
!! [Replaces] 1 [as true special symbol]
! [Replaces] 0 [as false]
# [Replaces] ! [as disabled]
o True and false transition time delays have changed.
~^(...) [Replaces] ~^1(...)
~^!(...) [Replaces] ~^0(...)
o Enabled monitoring and capture operators changed.
A then B [Replaces] A &~& B
A capture B [Replaces] A &^& B
o Updates have been made to examples of the "show" command
to reflect minor display changes. (See Features
and Incompatibilities below.)
o Updated to indicate trinary logic operators reverted
back to generating only one true value 1.
Old: A & B returns B when A is True (excluded 0) else A
New: A & B returns 1 when A and B are True (includes 0)
returns ! when A or B is False (! instead of 0)
returns ? when one is True and the other Unknown
o Introduced conditional operators as replacement for
prior feature of trinary logic operators returning
the full range of true values. Unlike the prior
feature, these operators do not descriminate against
zero which is now an additional True value.
Old: A & B returns B when A is True (excluded 0) else A
New: A true B returns B when A is True (includes 0) else A
o Introduced "Redefine" command.
define r1 on(a and b);
redefine r1 on(a or b);
o Introduced the terminology "node sentence" for the construct
where arguments are passed to a node in a formula, assertion,
or command.
node(args)
o Introduced node facets as part of a node sentence.
node_facet(args)
* Incompatibilities:
o When a rule term is referenced in a cell expression,
the term no longer maps all true values to 1. Instead,
the value of the condition cell is returned. This is
to maintain consistency between rule references and
simple cell references. However, if you have a rule
set that depends on rule terms returning 1 when true,
you will need to modify your rules for them to work
with this release or higher.
define r1 on(a or b);
define r2 on(r1=1 or c); --> change this
define r2 on(r1 or c); <-- to this
o A zero, "0", is no longer treated as False in logical
operations. Instead, a special symbol "!", is
used to represet False. This means every reference
to "0" in rule files and check scripts must be
replaced with "!". References to "0" as a number,
where there is no expectation that it be interpretted
as False, need not change. This change, while
disruptive, has a logical purpose which is described
in the Features section below.
o When disabled terms are displayed using the show
command, there are differences in the display
(see Features below) that will cause check scripts
prepared for prior releases to fail when using
show commands on disabled terms. You will need
to modify these check scripts for use with 0.9.00
and beyond.
o When a relational operator has a constant on the
left and variable on the right the operands are
reversed. This will cause check scripts using a
show command for the condition to fail. The solution
is to update the check line starting with "~" to
show the operands reversed:
"a"=a ==> a="a"
"a"<>a ==> a<>"a"
"a" a>"a"
"a"<=a ==> a>="a"
"a">a ==> a<"a"
"a">=a ==> a<="a"
o Top glossary symbol changed from "@" to "_". There
has always been a mostly invisible root glossary
named "_" and in prior versions a local glossary
under it named "@". This dates back to early versions
where peers where understood by the interpreter and
they each had a context name starting with "@". That
notion is obselete, so the local glossary named "@"
has been elinated and the top glossary "_" is now
visible in the way "@" used to be. This means a
show command will produce different output at the
top and check scripts must be modified.
_ = # == node [top node in show command now]
@ = ! == node [top node in show command prior]
o Term glossaries are now displayed in alphabetical
order by the SHOW command. This will cause check
scripts created for prior versions to fail. This
can be resolved by reordering the check lines ("~")
in the scripts.
> show -t
Prior versions displayed terms based on how the
glossary was organized. By displaying them in
alphabetical order, the display is easier to read
and less likely to change in the future if the
glossary is reorganized.
* New Features:
o Cell evaluation in response to assertions has been
accelerated in cases where a term is compared to
a constant. The benefit of this acceleration depends
on how many cells reference unique constants in
comparison to any given term and the frequency of
assertions to the referenced term.
o Rules (on,when,if) now pass thru the value of the
condition when referenced, like a cell term. Prior
versions converted all true values to 1. This change
ensure consistency when referencing named cells. A
rule condition is just a cell condition.
define x cell a or b;
define r1 on(x or y) c=2;
define r2 on(r1); # reference to value of (x or y)
o A zero, 0, has joined with every other number and
character string as a True value. A "!" symbol is
now used to represent False, just as "?" is used to
represent Unknown. While this is a break from the
tradition of using 0 for false, it enables a value
of zero to be handled constently with other values
in logical expressions with handy side effects. For
example, we can define X to be A, or default to 10
if A is False or Unknown.
define X cell A | 10;
If 0 is used to represent False, then X can never
take on a value of 0. By using a special False
value represented by !, all numbers and character
strings can pass through A to X. Only A values
of False (!) and Unknown (?) will cause X to default
to 10.
This applies to other logical operators the produce
various True values. In the following example, Y
is 10 as long as A is True. Now a value of 0 is
just as True as every other number or string. The
value of Y only takes on the value of A when A is
False (!), or Unknown (?).
define Y cell A & 10;
It feels strange to break from the tradition of
using 0 to represent false, but within the context
of NodeBrain logical operators, it would be less
logical to maintain the tradition.
o When disabled terms are displayed using the show
command, the value of an enabled formula will now
display.
x = 5 == a+b [x is enabled with value 5]
x = # 5 == a+b <<--- [x is disabled but a+b is 5]
x = # == a+b [x and a+b are both disabled]
The last two examples above would display as follows
under prior versions, indicating x is disabled without
revealing the state or value of a+b. Notice there is
also a change from "!" to "#" as the indicator that the
term is disabled. This is because "!" is now the
symbol for False.
x = ! == a+b
o A new data type of "set" has been included. This is
an internal feature with some similarity to the Tree
module. The differences are:
1) A set is one dimentional, while a Tree node is
multi-dimentional.
2) A set does not provide for association, while a
Tree node does.
3) A set can be used in symbolic substitution,
while a Tree node can not. This is only useful
for small sets, since it is not practical to
symbolically process large sets.
o Operations on set cell types have been included.
This enables the addition of values to sets,
evaluation to determine if a value is in a set,
and removal of values from sets.
o The show command now supports a comma separated
list of display options.
> show a,b,c i,-r
o Event attribute terms starting with @ have been
introducted for use with the ALERT command. The
value of these terms automatically resets to Unknown
on the next alert to the same node, unless a value
is assigned.
alert @a=1,@b=2;
alert @a=3; // @b=?
alert @b=1; // @a=?
* Deprecated Syntax:
o The state transition time delay syntax of ~^1(...)
and ~^0(...) is deprecated because 0 is no longer
used to represent False. The prefered syntax is now
~^(...) delay transition to True
~^!(...) delay transition to False
~^?(...) delay transition to Unknown
o The "not" operator has been deprecated to support
a goal of not having any reserved terms. Once it
is dropped as a prefix operator (use ! instead),
the term "not" can be used to name a cell.
o The @ symbol is deprecated a name for top context.
Use _ instead. Use of @ will cause a Warning message.
define r1 on(@.a=1 or a=2); // replace this
define r1 on(_.a=1 or a=2); // with this
* Dropped Syntax:
o The previously deprecated "address" command is no
longer recognized to produce a hint to use ">"
for interactive command prefix.
o The previously deprecated single quote for defining
command prefixes no longer produces a warning.
o The previously deprecated syntax ~T(...), ~F(...), and
~U(...) for time delays has been dropped and no longer
generates a warning message.
* Bug Fixes:
o Previously a sentence could be specified using a
undefined term for the node. The intent was to
enable the node to be defined after referencing
rules. However, the intepreter didn't allow the
node to be defined later. Although the term was
automatically defined to be undefined, an attempt
to define it as a node resulted in an error message
saying the term was already defined.
This bug has been resolved by requiring a node to
be defined before it is used in a sentence. This
seems not to create any hardship.
o State transition time delays didn't work properly
when multiple types of delays were placed on a
common condition. This has been fixed.
============================================================
NodeBrain 0.8.16 (Dopey) Change Summary
* Released February 16, 2014
* Theme: Build Options
This release is intended simply to provide the option
to exclude OpenSSL related features and specified node
modules from a build using ./configure --without-XXXX.
* Documentation:
o NodeBrain Guide converted to texinfo
o NodeBrain Guide includes build options (e.g. --without-tls)
o NodeBrain Language - Minor revision to SHOW command
* Incompatibilities: (none)
* New Features:
o Top level ./configure now handles lib and module
configuration to shorten the time to configure.
o --without-tls may be used on ./configure command to
exclude OpenSSL dependant features.
o --disable-nb_ may be used on ./configure to
exclude the specified node module.
o The SHOW command now accepts a comma separated list
of options.
* Deprecated Syntax: (none)
* Bug Fixes: (none)
============================================================
NodeBrain 0.8.15 Change Summary
* Released May 25, 2013
* Theme: Packaging
Cleaning up the packaging a bit before
submitting to a couple Linux distributions.
* Documentation:
o %use directive added.
* Incompatibilities:
o The directory where node modules are installed
and searched for by default has changed. If anyone
installs custom node modules in the old default
locations, they will not be found by this release
of NodeBrain. You can resolve this problem by
setting the NB_MODULE_PATH environment variable.
o Modules are no longer loaded using the major version
symbolic link created by libtool. The module version
numbers and symbolic links have been removed.
New: /usr/lib64/nb-0.8.15/nb_audit.so
Old: /usr/lib64/nb/0.8/nb_audit.so.0 -> ../nb_audit.so.0.0.1
You may still use version numbers on your node modules
if you like, but the base symbolic link will provide
access to your module instead of the .0 link.
* New Features:
o Debian packaging files are now included in a debian
directory, and a prototype nodebrain.dsc file is
included at the top level. The digest in this file
must be replaced when creating a debian package,
since it can not be correct and be included within
the original source file.
o Node modules are now installed to ${libdir}/nb-${version}
instead of just ${libdir}/nb, and the minor
version directory ${libdir}/nb/. and
associated symbolics have been eliminated. This change
is intended to better enable the use of multiple versions
of NodeBrain on a machine.
o Modules are no longer built with version numbers. The
path identifies the version.
o When installed using an rpm file built with "make rpm",
the symbolic links produced by libtool for modules
are no longer installed.
o The package was modified slightly to enable the --job
make option for faster builds.
o The %{?_smp_mflags} macro is used to set the --job
make option in an RPM build.
o ChangeLog files are created automatically from the
source repository.
o The %use directive has been added. It is similar to
the %include directive and the source command, except:
1) It sources the specified file at the top level
context instead of the current context.
2) It only sources the file if it hasn't already
been sourced.
3) It does not accept parameters.
This is intended for files that provide a resource
to other files. By including %use directives in
files that require the resource, the high level
files (e.g. an agent) is not required to know
while resource files are required by the files it
sources.
* Deprecated Syntax: (none)
* Bug Fixes:
o Some of the packaging "new features" identified above
actually address deficiencies identified in by Jason
Tibbitts in a Fedora package review, see Red Hat
Bugzilla Bug 592504.
o A bug was fixed in a translator function. Previously
references to undefined named subpatterns in regular
expressions caused an array indexing error.
o A overlapping strcpy bug was fixed in function that
handles line continuation.
============================================================
NodeBrain 0.8.14 Change Summary
* Released February 11, 2013
Versions 0.8.4 through 0.8.13 were not released.
Although 0.8.3 software was released, the website
was not updated with new documentation.
* Theme: Security Patches and Document Format
Many security patches are included in this release
and primary documents have been converted to texinfo.
Although only a couple insignificant functional changes
are included in this release, the features introduced
in the 0.8.3 release will be new to most readers.
See news below for NodeBrain 0.8.3.
* Documentation:
o Documents have been coverted from MS Word masters to
Texinfo masters.
Note: We anticipate switching from Texinfo to DocBook
as the master format in the future.
o The NodeBrain Module Reference has been replaced by
individual texi manuals for each module.
* Incompatibilities
o The "greater than" (">") is now used instead of a single
quote (') to set a command prefix in interactive mode.
Use of a single quote was incompatible with the single
quoted terms feature. A command must be able to start
with a single quoted term identifying a node.
o We messed up and broke binary compatibility with 0.8.3
in 0.8.9. Because documentation for 0.8.3 was not
released and it had few downloads, we did not resolve
this problem in 0.8.13. We are treating 0.8.13
effectively as the first real 0.8.x release. The
incompatibility is in the Message API introduced in
0.8.3.
o The Webster module is changed since 0.7.4, requiring
modification to configuration rules.
* New Fetures
o An nbkit command has been introduced to support
NodeBrain kits provided by other packages.
o The ">" command replaced the single quote command
for defining an interactive command prefix.
* Deprecated Syntax:
o None
* Bug fixes:
o A bug was fixed in an internal message queueing
mechanism that malfunctioned when messages longer
then 4K were queued. This condition could occur
when passing messages as input to a Servant node.
o Many security flaws were fixed.
============================================================
NodeBrain 0.8.3 Change Summary
* Released September 6, 2010
Versions 0.7.5 through 0.7.9 were not released.
Versions 0.8.0 through 0.8.2 were not released.
Actually 0.8.0 was released to SourceForge, but this
release was not documented at www.nodebrain.org.
* Theme: Message Cabals and Statistical Anomaly Detection
A NodeBrain message cabal is a set of nodes that
broadcast messages to every node in the cabal. The
goal is to ensure rapid one-time delivery of each
message to every other node in sequence for each
originating node. This enables a collection of
NodeBrain agents to share a set of knowledge more
efficiently and reliably than is possible using the
peer module.
Statistical anomaly detection capability
* Documentation:
o Message and Baseline modules have been documented
in separate Texinfo files.
* Incompatibilities:
o None intended since 0.7.4
* New Features:
o Node modules may now implement commands independent
of nodes using the following syntax.
.
This is an alternative to a node module providing a
utility skill and requiring the user to first create
a utility node.
define node .utility;
:
Either of these approaches is appropriate in cases
where module specific commands are needed to configure
a node module in some way (e.g. define keys for a
communications module) or operate on files managed
by a node module.
o Included the NodeBrain Message Cabal feature. This
provides a set of C API functions for reading and
writing messages to a message log and sharing the
content of a message log between nodes. This is
intended as both a performance and functional
enhancement over NodeBrain queues. In addition to
the API functions, a "message" module is included
that implements the message cabal feature for
NodeBrain commands. Other modules may use the API
to implement the message cabal feature for different
types of messages.
o Statistical anomaly detection is supported by a new
module, Baseline. This module maintains two statistics,
average value and average deviation, for any number of
measures. It alerts when values are outside of user
defined limits expressed as a tolerance factor in units
of sigma (standard deviation).
* Deprecated Syntax:
o None intended since 0.7.4
* Bug fixes:
o Cntl-D at command line crashed under 0.7.4 and was
fixed in 0.7.5.
o Expression reduction error for xor and nor was fixed
in 0.7.9. Prior versions incorrectly reduced these
expressions to the left expression.
o Expression reduction error for "not closed world"
causing "![]a" to be reduced to "0" was fixed in
0.7.9
============================================================
NodeBrain 0.7.4 Change Summary
* Released February 9, 2009
* Theme: Nodes and Performance
Since this is the first public release since
0.6.4 and 0.6.5 in April of 2006, this is an
accumulation of changes applied to multiple
versions over this period. We are restating
these changes here to clarify, particularly
since this version make obsolete several
features that were only deprecated previously.
* Documentation:
o NodeBrain Tutorial has been expanded to include
some distributed node modules.
o NodeBrain Tutorial has been converted to GNU Texinfo
format.
o Other documents will be provided in PDF format only
until converted to GNU Texinfo format.
o Many updates applied to support syntax changes.
* Incompatibilities:
o Symbolic substitution has changed.
o ADDRESS command replaced by single quote prefix
o In a DEFINE command, "listener" is replaced by various
types of nodes. New skill modules are included to
provide the same functionality as deprecated listeners.
o In a DECLARE command, "brain" is replaced by a DEFINE
command for peer node; that is, a node using the peer
skill module.
o The PORTRAY command is replaced by an option of the
peer skill module.
o The COPY command is replaced by the peer skill module.
o The >, / and \ commands are replaced by options of the
peer skill module.
o In a DEFINE command, "file" is replaced by an audit node;
that is, a node using the audit skill module.
o The PIPE command is replaced by the audit skill module.
o The CONSULT command is replaced by the - and = commands.
o The TRANSLATE command is replaced by the translator node
module.
o The action priority is now called the action slice, and
the polarity has changes.
o The IDENTIFY command is now a peer module command.
* New Features:
o Translator symbolic substitution supports alternate
character replacement.
o Translator feature now supports a hierachical syntax.
o New peer skill module replaces NBP and NBQ listeners
and all related commands.
o New audit skill modules replaces LOG listener, FILE
object type, and PIPE command.
o New pipe skill module replaces FIFO listener.
o New mail skill module replaces SMTP listener.
o Updated syslog skill module is ready for use.
o The Perl Compatible Regular Expression (PCRE) library
is now used on Unix, Linux, and Windows. We previously
used the native regcomp and regexec functions on Unix
and Linux and the rxspencer.dll from GnuWin32 on Windows.
The libpcre.so and libpcreposix.so libraries are now
prerequisits on Unix and Linux (see www.pcre.org). For
Windows, we distribute with NodeBrain a precompiled
pcre3.dll and pcreprosix3.dll obtained from the GnuWin32
project. This change makes NodeBrain translator files
portable across platforms and provides enhanced functionality
and performance on some platforms.
o The GNU readline function is used on Unix/Linux to enable
history and input editing. We elected not to use this on
Windows because history and input editing are natively
supported. It seems better for the user experience
to match the platform in this case.
* Deprecated Syntax:
o In a DEFINE command, "node" replaces "expert". This
change was made with the hope that it would help users
better visualize the structure of NodeBrain rules.
o The reqular expression match operator "~" replaces
"~~".
* Bug fixes:
Several bugs were fixed, created, and fixed. They
were not recorded and tracked properly to enable
listing here.
============================================================
NodeBrain 0.6.9 Change Summary
* Internal March 10, 2008
* Theme: Nodes and Performance
Since 0.6.8 was not released to the open source
project, the theme of this release is primarily
that of version 0.6.8---Nodes. Version 0.6.9
adds some internal changes that improve performance
for applications with high transaction rates. More
performance enhancements are planned for future
releases.
* Documentation:
Minor corrections to 0.6.8 document updates.
* Incompatibilities:
None - see 0.6.8
* New Features:
None - see 0.6.8
* Deprecated Syntax:
None - see 0.6.8
* Bug fixes:
============================================================
NodeBrain 0.6.8 Change Summary
* Internal August 5, 2007
* Theme: Nodes
This release is designed as a path to a planned
release 7.0. We are placing built-in functionality
with skill modules where the functionality is not
a central part of the interpreter. This separation
is intended to simplify enhancement via skill module
substitution. A node is now the object implemented
by a skill module (prevously "expert"), and features
previously built-in as "listeners" are now implemented
by new skill modules. In particular, the NodeBrain
protocol (NBP) has moved to the peer skill module. All
commands related to NBP are now extended commands of
the peer skill module. You should now visualize a
NodeBrain process as a collection of nodes that may
interact with one another, and in some cases provide
communication with external elements, including nodes
within other NodeBrain processes.
* Documentation:
All released documents have updates. There are
several syntax changes introduced in this release.
Deprecated syntax is now undocumented, even though
support continues until the next release.
* Incompatibilities:
The ADDRESS command is no longer supported. This
was a feature used only in interactive mode, so no
rule files should be impacted. In interactive mode,
the single quote (') special symbol command is now
used to establish a command prefix. However, it
differs significantly from the ADDRESS commmand.
* New Features:
o Translator symbolic substitution supports alternate
character replacement.
o New peer skill module replaces NBP and NBQ listeners
and all related commands.
o New audit skill modules replaces LOG listener, FILE
object type, and PIPE command.
o New pipe skill module replaces FIFO listener.
o New mail skill module replaces SMTP listener.
o Updated syslog skill module is ready for use.
o The Perl Compatible Regular Expression (PCRE) library
is now used on Unix, Linux, and Windows. We previously
used the native regcomp and regexec functions on Unix
and Linux and the rxspencer.dll from GnuWin32 on Windows.
The libpcre.so and libpcreposix.so libraries are now
prerequisits on Unix and Linux (see www.pcre.org). For
Windows, we distribute with NodeBrain a precompiled
pcre3.dll and pcreprosix3.dll obtained from the GnuWin32
project. This change makes NodeBrain translator files
portable across platforms and provides enhanced functionality
and performance on some platforms.
o The GNU readline function is used on Unix/Linux to enable
history and input editing. We elected not to use this on
Windows because history and input editing are natively
supported. It seems better for the user experience
to match the platform in this case.
* Deprecated Syntax:
o In a DEFINE command, "node" replaces "expert". This
change was made with the hope that it would help users
better visualize the structure of NodeBrain rules.
o In a DEFINE command, "listener" is replaced by various
types of nodes. New skill modules are included to
provide the same functionality as deprecated listeners.
o In a DECLARE command, "brain" is replaced by a DEFINE
command for peer node; that is, a node using the peer
skill module.
o The PORTRAY command is replaced by an option of the
peer skill module.
o The COPY command is replaced by the peer skill module.
o The >, / and \ commands are replaced by options of the
peer skill module.
o In a DEFINE command, "file" is replaced by an audit node;
that is, a node using the audit skill module.
o The PIPE command is replaced by the audit skill module.
o The CONSULT command is replaced by the - and = commands.
* Bug Fixes:
============================================================
NodeBrain 0.6.5 Change Summary
* Released April 20, 2006
* Theme: Servant Program Interface (Windows)
This is essentially a re-release of 0.6.4 with fixes
for defects discovered on Windows after 0.6.4 was
release for Unix and Linux.
* Documentation:
We are not releasing document updates with this
release. Changes described in this file will be
incorporated into the 0.7.0 document release.
* Incompatibiilties:
None
* New Features;
o A "^" symbol may be used instead of ":" for sending
messages to stdout. Since we use ":" to override a
remote prompt in interactive mode, we had no way to
send a message to the parent of a remote agent. By
using "^" instead of ":" you can avoid this conflict.
We expect to deprecate and then drop support of ":"
to send messages to stdout in future releases.
o The source file directive %include has been added as
an alternative to the SOURCE command. A directive
seems more appropriate because the optional assertion
following the file name is intepreted within the
local context like other directives instead of the
current command context.
* Deprecated Syntax:
None
* Bug Fixes
o The -d (daemon) option is now implied when running
as a Windows service. Without this fix a Windows
service would stop after loading the configuration
file if there were no "old style" listeners defined.
o A bug was causing NodeBrain to automatically restart
under some conditions when running as a Windows
service a and receiving a stop request.
o A console is now allocated when running as a service
to enable management of servants as console groups.
Without a console NodeBrain was not properly cleaning
up servants when shutting down.
o When an expert was defined without a skill module
and then referenced in an expert command, condition
or assertion, the interpreter crashed with an
addressing exception. This has been fixed.
o Identifiers starting with "@." were not properly
handled as a reference to the root context. This
has been fixed.
o The special case of ". " used for a context prefix
was not recognized. We now recognize it as a
reference to the current context, which has no
impact.
============================================================
NodeBrain 0.6.4 Change Summary
* Released April 1, 2006
* Theme: Servant Program Interface (Unix/Linux)
This release introduces a new interface for extending
NodeBrain functionality by writing "servant" programs
or scripts in any language. Using this interface a
servant program communicates with NodeBrain using stdin,
stdout and stderr. This is a much simpler interface to
use than the C API introduced in prior releases.
Because this is new functionality, and because we have
introduced some incompatibilities, this should not be
treated as a patch release as the number would indicate.
* Documentation:
Because of new features and incompatibilities we have
updated the documentation. We also elected to split
the old NodeBrain User's Guide into multiple documents.
NodeBrain User Guide
NodeBrain Language Reference
NodeBrain Module Reference
NodeBrain API Reference
* Incompatibilities:
o The underscore ("_") may no longer be used within a
simple term. For example, the following definition
will produce an error message.
define user_cpu cell 5;
o The -s option for nb is now used for the --servant
instead of the --solve option.
o A verb may no longer be terminated by the symbols
"(" or ":". These terminators now cause a verb to
be interpreted as a skill module extended expert
reference. The use of the "+" prefix for this purpose
is now deprecated.
o Context prefixes without a trailing period are no
longer supported and will be interpreted as a verb.
When a command starts with an expert name, the name
must be terminated with ".", "(", or ":".
* New Features:
o The "-" and "=" prefix commands are now called
"servant" commands and support a more complete
syntax. For example, when these symbols are follows
by a semicolon (":"), NodeBrain interprets the stdout
of the child process as NodeBrain commands.
o A "+" is no longer required as a prefix when sending
commands to a skill module extended expert. The
terminating symbol is now the differentiator between
an expert reference and a verb.
o A servant module is provided for the definition of
servants that accept commands on stdin. Commands
sent to experts extended by this skill module are
forwarded on to the servant program.
* Deprecated Syntax:
o The "+" prefix for referencing skill module extended
experts is now deprecated.
============================================================
NodeBrain 0.6.3
We elected not to release the 0.6.3 version, a patch
release applied to the author's applications.
============================================================
NodeBrain 0.6.2 Change Summary
* Released May 8, 2005
* Theme: API Cleanup
In release 0.6.2 a new header (nbapi.h) is introduced
to avoid exposing NodeBrain's internal structures
to programs using the C API. This should help
programmers avoid dependence on NodeBrain internals
and reduce the opportunities for API programs to break
under new releases. After all, that's one of the points
of an API. In addition, new API functions are included,
more attentions has been given to using the API from a
custom main routine, and it is now a bit easier to
statically link extended skills into a program as an
alternative to the preferred dynamic modules.
Because there are few, if any, people programming skill
modules at this point, it was decided to go ahead and
create incompatibilities with the 0.6.1 API.
* Documentation:
o Normally we don't plan to release document updates
with patch releases. However, we've slipped some
enhancements and incompatibilities into 0.6.1 and 0.6.2
that require document updates. Rather than waiting to
roll these into documentation for 0.7.0, we've elected
to update the documentation with this release.
* Incompatibilities:
o We have changed the naming standard for skill binding
functions in an expert skill module.
INIT() changed to nbBind()
changed to Bind()
o Numerous changes where made to API function parameters
and skill module API methods.
o A cache no longer creates terms for the threshold levels.
_threshold0="normal"
_threshold1="minor"
_threshold2="major"
_threshold3="critical"
We stopped doing this because there were few cases where
it seemed useful to have the terms defined. Now the values
remain the same, but you have no access to modify these
values. If alternate values are required a translation
table can be implemented using a tree. For example, you
could use the following tree to translate them into numbers.
define myThreshold expert tree;
myThreshold. assert ("normal")=0,("minor")=1,("major")=2,("critical")=3;
This tree could be combined with a cache like this.
define myCache expert cache:(a(3,6,9));
myCache. define r1 if(myThreshold(a._hitState)>1);
Another possibility for the future would be to support assignment
of these values at skill definition time. This is just hypothetical.
We do not support this currently.
define mycache skill cache:thresholds("ok","oops","ohmygosh","panic");
define myCache expert mycache:(a(3,6,9));
* Bug fixes:
o SOURCE command supports quoted file names with spaces.
This was required on systems that allow spaces in file
names.
o Regular expressions are now supported on Windows with
the help of the rxspencer.dll from the GnuWin32 project's
"RegEx-Spencer" package. Source code and updates are
available at gnuwin32.sourceforge.net
* New Features:
o The tree skill is now included in the NodeBrain
library (libnb.a) in addition to a dynamic module.
o The cache skill is now implemented using the skill
module API although it is still statically linked
into nb.
o A new WINDOWS command verb SHOWENV has been included.
> windows showenv;
o New API functions have been included for skill module
development.
nbListenerReplace()
nbListenerEnableOnDaemon()
nbOutputHandlerAdd()
nbOutputHandlerRemove()
nbSynapseOpen()
nbSynapseClose()
o An environment variable NB_MOD_PATH may be used to
assist NodeBrain in locating skill modules. This is
similar to the PATH environment variable. Since
NodeBrain uses the native interface for loading modules
you may use platform specific environment variables
to direct the loader. The NB_MOD_PATH variable
provides an "almost" platform independent method of
specifying the directory search order for skill modules.
The path separator is different on Windows from other
platforms: ';' on Windows and ':' on other platforms.
Here's an example where the variable is passed to nb
on a Unix/Linux system.
NB_MOD_PATH=".:/tmp" ./nb mytest.nb
o You may now specify a path with multiple directories
when declaring a module.
declare tree module {".:/tmp"}tree;
This syntax is preferred even when you only specify
one directory, because it allows NodeBrain to construct
the file name for you, causing your rules to be more
platform independent.
declare tree module {"/tmp"}tree; # This is preferred
declare tree module "/tmp/nb_mod_tree.so"; # over this
If you know your rules will be used on only one platform,
you may actually prefer the second line above because it
is easier to read. You have a choice. But the first line
above is easier to modify to add more directories later
and you never know when you may want to port rules from
Linux to OS X.
* Experimental Features:
We refer to these features as "experimental" because we
are introducing a "preliminary implementation" that is
likely to undergo refinement relatively quickly. In
other words, the design is unstable.
o Internet Protocol (IP) API functions for skill
module development
nbIpGetName()
nbIpGetUdpServerSocket()
nbIpGetDatagram()
nbIpGetAddrString()
nbIpGetSocketAddrString()
o Stream API functions for skill module development
nbStreamProducerOpen()
nbStreamConsumerOpen()
nbStreamConsumerClose()
nbStreamMsg()
o Translation API functions
nbLoadTranslator()
nbTranslate()
o Console skill module
When NodeBrain runs as a monitoring agent there are
two major functions that require a user interface:
1) rule configuration, and
2) visibility of the state of monitored elements.
In prior releases we have been content to rely on
existing user interfaces for these functions. For
example, an SSH client can be used with VI to edit
rule configuration files and an email inbox can be
used as an alert viewer. The NodeBrain interpreter,
nb, is itself a line mode client that can be used
for remote configuration of an agent, and for
viewing the internal state of rule conditions.
However, for some applications of NodeBrain, it
seems that a graphical user interface (GUI) will be
more appropriate. Although we didn't plan to
entertain this notion in a 0.6.x release, we have
decided to build a console GUI to support an
application that uses one of our private Expert
Skill Modules. We have generalized the required
enhancements to nb by extending the Expert Skill
Module API. The prototype NodeBrain Console itself
is a Java application that will be released as a
separate package.
o Other skill modules
netflow - worm detection
snmptrap - V1 SNMP Trap monitor
syslog - remote syslog monitor (UDP port 514)
translate - execute NodeBrain translation rules
* Deprecated Syntax:
o Enhancements to the module declaration syntax make
it unnecessary to support the ".?" wild character
in module declarations and this is now deprecated.
declare fred module /tmp/nb_mod_tree.?; (old)
declare fred module {"/tmp"}tree; (new)
declare fred module nb_mod_tree.?; (old)
declare fred module tree; (new)
It is no longer necessary to declare installed
modules with matching skill and module names
when you reference them by this name.
# This declare is unnecessary.
declare mymod module /usr/local/lib/nb/nb_mod_mymod.so;
# NodeBrain will find the installed module.
define mystuff expert mymod(1,2,3);
If the skill and module names don't match, you can
still avoid the module declaration for install modules.
define mystuff expert mymod.stuff(1,2,3);
o It is no longer necessary to enable experts that
use skill modules (e.g. snmptrap) that listen. These
modules will now enable automatically when NodeBrain
becomes a daemon/service.
define snmptrap expert snmptrap;
enable snmptrap; # don't need this to start listening
Once in deamon/service mode, you may elect to disable
and enable a listening expert. It just isn't necessary
to enable it the first time.
o The syntax for cache definitions has changed slightly.
define processes expert cache(~(h):parent,child); (old)
define processes expert cache:(~(h):parent,child); (new)
This is necessary to get the old built-in cache feature
to conform to the syntax for experts.
define expert [(arglist)][:text]
NodeBrain parses everything up to the text, and the skill
module parses the text. For compatibility with existing
rules, the interpreter still recognizes cache as a special
case and will pretend the ":" was coded after cache. An
warning message is produced to encourage an update to the
rules. The deprecated syntax will be an error in some
future release.
* Packaging:
o A Microsoft Installer (nb.msi) file is now provided
to support installation on Windows following native
customs that support Add/Remove.
o A Windows help file has been included in the Windows
binary distribution.
============================================================
NodeBrain 0.6.1 Change Summary
* Released October 11, 2004
* Theme: Cleaning up bits and pieces.
As a patch release, there is no one grand theme
here. However, there are small enhanecments and
some bug fixes that I found useful in my own
applications. For my own purposes, this release
has been more reliable than 0.6.0.
What's Next?
Starting to look forward to a 0.7.0 release. My
current plan is to focus on three things.
1) Systematic testing
2) Sample application(s)
3) Skill module enhancements
Better testing is needed to achieve the level of
reliability needed before going to a 1.0 version.
It works fine now for my own applications, but I
use it the way it works. It needs to be more
graceful in responding to the random command syntax
a new user might try. And at least one complete
sample application is needed to get people started.
* Documentation:
o At the time of this release, the "NodeBrain User's
Guide" has not been updated to reflect changes in
this release. When updated, the document will be
posted on the website, www.nodebrain.org. A document
release file will be posted on the SourceForge
project page. Please use the online 0.6.0 document
for now.
* Incompatibilities:
o Nested symbolic substitution for generating terms,
${{a}{b}}, is no longer supported. This feature
had little merit and conflicted with our desire to
support symbolic substitution using cell expressions.
o Expert skill module compute() methods are now
expected to return a grabbed cell. It is unlikely
anyone out there has dabbled with writing skill
modules yet.
o Rule actions are no longer performed when a rule
condition changes after the action is scheduled.
When a change causes multiple rules to fire, the
action of one rule may change the condition of
another. If this happens, NodeBrain now considers
it unsafe to perform a scheduled action whose
condition has changed. This is because actions
often use terms within the condition as parameters.
An "action priority" option has been included to
help avoid this situation.
* Bugs Fixed:
o Multiple bugs related to releasing of objects.
o Corrected the order of symbolic substitution and
reduction. This does not impact commands injected
by rules, but does resolve a problem for user
entered commands starting with a reduction ("$ ").
o Eliminated unnecessary pass through symbolic
substitution logic for rule action commands that
don't need it. Check is made at rule definition time
now instead of every time the command is parsed.
o Symbolic reduction "$ $${..}" to "${..}" is done
for rule action commands at rule definition time
now. Stopped doing every time the command is parsed.
o Rules are no longer allowed to fire more than once
in a given command cycle. This was documented but
not implemented prior to this release.
o Fixed bugs related to the use of rule terms in cell
expressions. A rule term may be used as a name for
the rule condition cell. Notice r1 in this example.
define r1 on(a=1 and b=2):-echo hi
define r2 on(r1 or c=3):-echo ho
o Fixed bugs in the "solve" command. The solve
command may now be used multiple times in the
same context. State changes may cause "solve"
to resolve previously unresolved terms. You may
also assert terms to be unknown, causing solve
to resolve them again if necessary.
o The "show" command reveals context a little better.
A context prefix is included when rules are displayed,
unless the context matches the current context. When
a context terms is shown, it is reduced to ".". A
period may also be used as an abbreviation in the show
command. > show .
o The new form of cache assertion introduced in 0.6.0
was not properly reacting when a threshold was hit.
The has been fixed, but the fix introduces an
unfortunate inconsistency in the assert command. As
"fixed" the following example will cause rFirst to
fire twice, once for 1, and once for 2.
define johnny expert cache(~(5m):x(1));
johnny. define rFirst if(x._hitState);
define rAssert on(a=1) johnny(1),johnny(2);
For the moment, I've designed myself into a corner
here. Previously we have said that all assertions
in a given command are applied "concurrently" and
then rules respond to the collective assertion.
However, when a cache hits a threshold it forces
an immediate response. This means the assertions
on a single command are no longer "always" applied
"concurrently". Here is an example of a situation
that violates our promise of "concurrent" assignment.
define c expert cache(x(1));
define r1 on(a=1);
define r2 on(a=2);
define r3 on(a=3);
assert a=1,c(1),a=2,c(2),a=3,c(3);
In this case, r1, r2, and r3 all respond because
c(1), c(2), and c(3) all hit a threshold and force
an immediate reaction. Had the assertion been as
follows, only r3 whould fire.
assert a=1,a=2,a=3;
In this example, it almost seems like a good thing.
But, when we change the rules a bit, the problem
is exposed. Rules r1 and r2 both fire instead of
just r2.
define c expert cache(x(1));
define r1 on(a=1 and b<>2);
define r2 on(a=1 and b=2);
assert a=0,b=0;
assert a=1,c(1),b=2;
For now we need to be aware of this and avoid coding
rules that are sensitive to this problem. In practice
it will not be difficult to avoid it, but I'm not
comfortable with this as a final solution.
* New Features:
o Symbolic substitution supports cell expressions
define r1 on(a=1) x=${trouble(y)*10+3}
o Show command supports cell expressions enclosed
in parentheses as alternative to a term.
show () [
Copyright © 2015 NodeBrain.org
|
|
