What's difference between libhs.so and libhs_runtime.so about hyperscan HOT 4 CLOSED

The short answer is that most users won't use libhs_runtime.

The runtime lib is the subset of the Hyperscan library required for scanning data, without the functionality for compiling patterns. That is, it doesn't contain hs_compile()/hs_compile_multi() or any of the support functions listed in hs_compile.h.

This means that to use the runtime lib, a pattern database would need to be compiled by a program linked to the full libhs, the pattern DB serialized, the DB moved/stored, and then deserialized by the program linked to libhs_runtime. For example, you might have a central service that compiles pattern databases which then sends the serialized DB out to a set of machines that use the HS runtime to scan network traffic.

As for the why: the runtime lib is obviously smaller than the complete library, but the main reason for its existence is that the runtime shared lib doesn't require libstdc++.so (or equivalent C++ runtime) - the HS runtime is entirely written in C, whereas the HS compiler is C++. So in the above example, Hyperscan doesn't require that the set of machines scanning network traffic have an installed C++ runtime.

from hyperscan.

thank you for your so detail answer.
Then Would you please tell me how to export compiled pattern DB? I don't find API to do this work.

from hyperscan.

We have API calls for serializing and deserializing the compiled pattern DB.

Serializing flattens the database into a sequence of bytes (with a length) that can be written to a file, or sent over a network connection, and then deserializing takes those bytes and turns them back into a database. Handling files and network connections is outside of the scope of the Hyperscan library.

from hyperscan.

Thank you so much. I have no other question. You can close it.

from hyperscan.