Skip to content

parse-live: Filter traces like syslog live (-m, -v, -mi, -vi, -r, -ri), highlighting the matches - #54

Merged
doronz88 merged 2 commits into
mainfrom
parse-live-match
Oct 20, 2026
Merged

doronz88 merged 2 commits into
mainfrom
parse-live-match

Conversation

@doronz88

Copy link
Copy Markdown
Collaborator

parse-live gains pymobiledevice3 syslog live's text filters, which highlight the matched parts (bold and underlined):

  • -m/-mi: every one must match; -mi ignores case.
  • -v/-vi: none may match; -vi ignores case.
  • -r/-ri: any regex is enough; -ri ignores case.

The regexes are -r/-ri rather than syslog's -e/-ei, because parse-live already uses -e for --event.

$ sudo pykdebugparser parse-live --bsc -m "ls(" -mi PRIVATE/TMP
2026-10-20 09:52:19.519233 [ls(]87809)    fstatat64(4294967294, "[private/tmp]", 0x16d721270, 0)

(Brackets mark the parts printed bold and underlined.)

The filter is library code, PyKdebugParser.line_filter = LineFilter(...) (pykdebugparser.line_filter), with the option help in MATCH_HELP, so pymobiledevice3's parse-live can take the same options. Filters match the printed line (time, thread, process and event), and with --json they match the line that would have been printed, as syslog's do.

Pace

--bsc with rich colors on a recorded Mac trace under find load (2.4M events):

filter lines kept events/s
none, main 1,046,844 488-491k
none, this branch 1,046,844 488-490k
-m connect (rare) 10 522-528k
-v find( 42,147 514k
-r 'open.*Library' 94 495k
-m open 225,012 486k
-m o (most lines) 660,320 407k
-mi FIND (nearly all lines) 1,004,737 383k

A dropped line is never colored, so a selective filter parses faster than no filter. A kept line's emphasized event is cached the way its colors already are. Live on this Mac, -mi a (most lines kept) ran 15 s twice with 0 dropped and 0 skipped.

No regressions

  • Output: without a filter it's byte-identical to main on recorded Mac and iPhone traces, colored and plain, with and without --show-tid (8 combinations, 0.9-1M lines each).
  • Kept lines: across 5 filter sets, the lines kept equal main's lines filtered by a reference implementation. Colored lines equal the plain ones once their escape sequences are stripped.
  • Emphasis: exactly the matched characters are emphasized on 590k real lines (including a regex spanning the process column and the event) and on 2,000 random fuzzed lines, colored or not. Spans equal re.finditer's on 20,000 random lines.
  • Tests: 272 pass on 3.9 and 3.15, and each commit passes on its own.

…tches

`PyKdebugParser.line_filter` takes a `LineFilter` with pymobiledevice3's `syslog live` filters: `match` (all must be in the line), `invert_match` (none may be), their case-insensitive forms, and regexes (any must match). `formatted_traces` and `dict_traces` give only the traces whose printed line (time, process and event) it keeps, and colored lines get the matches bold and underlined, inside the colors too (`emphasize`).

A dropped line is never colored, so a selective filter parses faster than none; the emphasized events are cached like their colors, so even a filter that keeps nearly every line costs ~20%. Without a filter, the output and speed are those of before.
…mi, -vi, -r and -ri

The options and their help are the ones pymobiledevice3's parse-live takes (from `MATCH_HELP`). The regexes are -r/-ri rather than syslog's -e/-ei, which parse-live's --event already has. They match the printed line in --json too, and highlight in both color modes.
@doronz88
doronz88 merged commit 1873120 into main Oct 20, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant