Since version 0.7.0 yaala can dump it's internal data into a file and read it the next time it runs to re-use already-pased data. This may be a speedup if you parse very big logfiles and is very useful for the daily runs. This may mean that you can delete old logfile while still see their data in the reports.
That is pretty cool, at least in my opinion. But it comes with a price: You used to be able to parse the logfiles in whatever order you want. This it not possible anymore since the parsers will think they already have that data is newer data exists. Maybe there will be a switch to turn that off in future versions but right now there it no such thing.
Also, since yaala is very flexible it doesn't always make sense to use the saved data. So if you play around it may happen that the earlier saved data is not being used but overwritten instead. Here I want to explain when this happens:
Along with the persistent data two config options are saved in the persistent-data file: ``logtype'' and (all) ``select''. These config options are checked against the ones coming from the config-file or command-line. If they don't match precisely the persistency-file will be overwritten.
This sound a bit limiting at first. But keep in mind that you can specify different files to store the persistency-information in. So you can realize something like that easily as a cron-job: --sample--
/path/to/yaala --persistency_file "data/squid" --logtype Squid \
--select "bytes BY user" /var/log/squid/access.log /path/to/yaala --persistency_file "data/apache" --logtype Common \
--select "requests BY date, hour" /var/log/httpd/access_log
Of course you can also use different config-files and just use something like this (save all the config options in extra config-files): --sample--
/path/to/yaala --config "squid.conf" /path/to/yaala --config "apache.conf" --sample--
If all this confuses you, you can turn of persistency in the config file. Have fun ;)
octo (at verplant.org)