Ra - filter syntax error

[elof2 at sentor.se]

Carter and I have discussed a very unusual error message; "filter syntax 
error", which may show up if the machine is HEAVILY burdened, like 
swapping a lot and/or receiving tons of interrupts, while feeding a long 
and complex filter expression to a ra* process.

> I haven't seen this problem before, but there maybe a simple fix.
> In order to get around a problem with using flex and bison to compile
> multiple filters at a time, we fork a process to compile a filter, and wait
> for that process to write the filter back to argus through a pipe.  We
> have specific error messages for the pipe creation, but we use a
> generic syntax error message if the forked process doesn't
> return a binary filter back to us in a timeout period, which is now set
> at 200 milliseconds.

I suggest that Carter add a specific error message for this 
particular scenario, logging the message "filter compilation timeout" 
instead of the generic "filter syntax error".

> In the argus-clients file ./common/argus_code.c, in the routine ArgusFilterCompile(),
> on line 389, we set the timer value.  Increase the time to, what, a second ?
> Here is a patch for the 3.0.6.2 code…..
> thoth:common carter$ diff argus_code.c.orig argus_code.c
> 389,390c389,390
> <       wait.tv_sec  = 0;
> <       wait.tv_usec = 200000;
> ---
> >       wait.tv_sec  = 1;
> >       wait.tv_usec = 0;


During the weekend I've had cron start ra with a long and complex filter 
string every 5 minutes.
With a timeout of 500ms, I had 9 "filter syntax error" in 34 hours.
(on an old Intel Xeon 3050 @ 2.13GHz machine from 2008)
(with 200ms I suspect I would have had approx 300 warnings)


So to prevent this message to appear "too often" on choked machines, you 
could increase the wait.tv_usec to 750000  ...or even higher if a higher 
value doesn't introduce any overall negative impact on ra*.



I now upped the timeout to 900000 just to see if that is enough to quell 
even those 9 warnings.

/Elof