A Rule Engine for State and Event Monitoring     










Get NodeBrain at Fast, secure and Free Open Source software downloads

Bug Reports

 _   _           _      ____
| \ | |         | |    |    \          ( )
|  \| | ___   __| | ___| | ) |_ _  __ _ _ _ __
|     |/   \ /    |/ _ \    <|  _|/    | |  _ \
| |\  | ( ) | ( | |  __/ | ) | |   ( | | | | | |
|_| \_|\___/ \__ _|\___|____/|_|  \__ _|_|_| |_|


NodeBrain 0.9.04 (Columbo) Change Summary

* Released September 24, 2015

* Theme:  Patch Release

     This version resolves a single defect that caused
     an infinate loop after encountering a specific
     sequence of commands.
* Packaging:

  o  Standard version related updates only

* Documentation: 

  o  Package document file updates only - no texinfo 
     document or manual page updates

* Incompatibilities: (None)

* New Features: (None)

* Deprecated Syntax: (None)

* Dropped Syntax: (None)

* Bug Fixes:

  o  #8 Corrupted Action List Loop

     A special sequence of rule definition, firing,
     redefition, and firing again, caused a corrupted
     action list that resulted in an endless loop. This
     has been fixed with a minor change.


NodeBrain 0.9.03 (Columbo) Change Summary

* Released December 14, 2014

* Theme:  Reduced Sensitivity to Command Arrival Order

     This version provides more flexibility in referencing
     nodes before they are defined. It also automatically
     resets event attributes to the unknown state when not
     specified on an alert, eliminating the need to specify
     all event attributes on every alert---required under
     prior versions to avoid event attribute values from
     impacting rule response to a subsequent alert.

* Packaging:

  o  The version scheme for the NodeBrain Library (libnb)
     has switched to using the Application Binary Interface
     version, instead of the release version based scheme
     used previously.  The release version approach was
     intended to require applications to build for every
     release, assuming there might be incompatibilities in
     every release. The change to an ABI based version is
     being made in preparation for a 1.0 release and 
     subsequent 1.x releases that will not require using
     applications to rebuild until release 2.0, except to
     gain access to enhancements in a 1.x release.    [0.9.02 prior release]   [0.9.03 this release]  [1.0.00 future release]

  o  The rpm spec file, and debian packaging files have 
     been modified to get better build results on various
     platforms after the switch from readline to libedit.
     The effort to make the project friendly to package
     maintainers for various Linux distributions is still
     in progress. However, rpmlint is silent on CentOS so
     the package will be submit to Fedora for review.

* Documentation:

  o  The NodeBrain Language manual has been updated to 
     cover new topics:

       - Alert attribute transience
       - Node functions
       - Cell functions
       - Redefine command (new in release 0.9.02)

     These topics were not covered previously because their
     introduction in the prior releases was experimental.
     Because of this, the incompatibilities introduced by
     this release for these features are expected to have
     little impact.

  o  The NodeBrain Library manual has been updated with
     additional API functions for:

       - Access to all terms defined within a node
       - Registration of simple cell functions.
* Incompatibilities:

  o  Applications using ALERT commands for both event
     and state monitoring may break under this release,
     requiring rule changes before upgrading.  You will
     only have a problem if you depend on some terms
     defined within a given node that are set by an ALERT
     to the node, retaining their value when subsequent
     ALERT commands to the same node do not set a value
     for the term.  This would mean some of the terms set
     by an ALERT are intended to express "state", while
     others express an "event".  Starting with this
     release, you will need to move all terms used to
     express "state" within ALERT commands to a different
     node. Otherwise, ALERT commands not setting the "state"
     terms will automatically cause them to revert to Unknown.
     This is not a problem for "state" terms that are set by
     all ALERT commands to the node. 

       define n node;
       n. alert a=1,b=2; # a and b may be state or event terms
       n. alert a=2,b=3; # No problem because same terms set
       n. alert a=3; # Problem if b is intended for "state"
       # Prior releases would leave b set to 3
       # This release resets b to Unknown

     If this is a problem for you, it can be resolved as
       define b cell; # Define state term in different node
       define n node;
       n. alert a=1,b=2; # a is for "event", b is for "state"
       n. alert a=3; # b is not reset to Unknown

  o  The special syntax for alert attributes has been
     dropped after introduction in the prior release. Terms
     starting with "@" are now interpreted as node functions
     instead of transient alert attributes.  We are making
     this change now under the assumption that there has
     been no significant adoption of either alert attribute
     transient terms or node functions.

  o  The syntax for node functions has changed abruptly under
     the assumption that there has been no significant
     adoption of this feature after introduction in the
     prior release. Node functions were briefly called "facets"
     because they are named after the facet of a node that they
     manage or access.  But it seems more natural to call them
     functions that access facets of a node.

       Was:      node_facet
       Now:      node@function  -or-   @function

     This freed up "_" for navigation of multiple level
     glossaries of terms within a node, and enables function
     reference within the context node without repeating
     the node term.

* New Features:

  o  The ALERT command now automatically resets terms defined
     directly within the context node to Unknown if set by 
     the prior ALERT to the node and not the present ALERT.
     This eliminates the need to set all event attributes in
     every alert to avoid unintended values from prior alerts.
  o  Node functions can now be referenced within the context
     node without specifying the node term.

       node@function(arglist) # previously node_facet(argList)
       @function(argList)     # previously unsupported

  o  Node functions can now be referenced before a node is 
     associated with a skill that provides the function.  This
     enables rules to reference node functions before the node
     is defined.  This is useful in cases where two nodes
     have rules that reference a function of the other.

       bill. define r1 on(a) fred@count(a,b)=9;
       fred. define r1 on(x) bill@measure(x,y)=27;

     After the rule definitions above, "fred" is implicitly
     defined to be a node with the "default" skill set.
     Since @count is not defined by the default skill, this
     function is associated with the unknown skill until the
     node is defined explicitly.

       define fred node foobar:(a,b);

     Once the "fred" node is explicitly defined, the
     @count function may be provided by the new skill.  If
     not, @count will continue to be provided by the
     unknown skill.
  o  A small set of commands, when used as rule actions,
     may now be accelerated.  You select this option by
     using "::" instead of ":" prior to a rule action

       define r1 on(a=1 and b=2) x=1::fred. alert y=2;

     The commands with acceleration support in
     this release are:
       system   - or =

     If you attempt to accelerate other commands, you will
     see a warning and the interpreter will revert to
     normal as if you had said ":" instead of "::".

     This feature is experimental and not yet included
     in the NodeBrain Language manual.  So it should only
     be used to experiment with the performance impact.

  o  Additional API functions have been included to
     simplify access to all terms within a node and
     obtain their name, value, and formula.

  o  The package now includes some API test programs that
     are invoked by "make check".  This is for build
     verification, regression testing, and to provide
     some examples for reference that are known to work.

* Deprecated Syntax:

  o  Built-in math function calls should no longer be 
     referenced using a syntax that looks like a node
     function call. Instead, use the backtick notation
     and the qualified name.

        assert x=mod(a,16);        <== old syntax
	assert x=`math.mod(a,16);  <== new syntax

     Under this version you will get a warning.  In a
     future release the old syntax will no longer be
     recognized.  This will eliminate name collisions
     with node function calls.

* Dropped Syntax: 

  o  "@" no longer used for alert attribute transient terms.
     Transience is now implied within the command context

  o  "_" no longer used following a node term to reference a
     node function.  "@" is used instead.

* Bug Fixes:

  o  Previous versions allowed multiple level term
     glossaries with subsequent definition of one of the
     intermediate terms as a node.  However, IF rules were
     associated with a node based on the node hierarchy
     existing at time of definition, and did not get moved
     when an intermediate term was subsequently define to
     be a node. This caused IF rules to respond to alerts
     to an unintended node, and not respond to alerts to
     the intended node.

     This is fixed by preventing a term that is not defined
     as a node from being defined as a node, an automatic
     creation of nodes when "." navigation is used, and a
     recognition of multiple level glossaries when "_"
     navigation is used.

  o  Previous versions allowed nodes to be redefine as
     simple cells and other object types.  Similar to the
     previous defect, this could cause IF rules to be 
     stranded in a way they could no longer be alerted.

     This is fixed by only allowing a node to be redefined
     as a node.

  o  When rules are defined they now properly put a reserve
     on the current value of the condition.  This was not
     done previously, causing unpredictable results under
     some patterns of defining and undefining rules.


NodeBrain 0.9.02 (Columbo) Change Summary

* Released August 13, 2014

* Theme: Performance, Logic, and License

     A primary goal of this version of NodeBrain is to
     improve performance for large rule sets with specific
     characteristics causing prior versions of NodeBrain
     to perform poorly.  This is based on theoretical rule
     sets, not rule sets of known applications, but the
     improvements are real.

     A secondary goal is to provide consistency in logic
     related to a performance improvement.  Basic logical
     operators no longer pass all true values through,
     converting all true values to a single true value to
     avoid unnecessary evaluation of dependent cells. For
     other functions that do pass all true value through,
     if was decided that special values of true and false
     should be provided as separate from all number and
     string values, make 0 and 1 both true and not special.

     Finally, in support of a change to the MIT License,
     dependence on GPL licensed libraries has being removed.

* Documentation:

  o  True, False and Disabled special value symbols have changed.

       !!            [Replaces]     1     [as true special symbol]
       !             [Replaces]     0     [as false]
       #             [Replaces]     !     [as disabled]

  o  True and false transition time delays have changed.

       ~^(...)       [Replaces]     ~^1(...)
       ~^!(...)      [Replaces]     ~^0(...)

  o  Enabled monitoring and capture operators changed.

       A then B      [Replaces]     A &~& B 
       A capture B   [Replaces]     A &^& B

  o  Updates have been made to examples of the "show" command
     to reflect minor display changes. (See Features
     and Incompatibilities below.)

  o  Updated to indicate trinary logic operators reverted
     back to generating only one true value 1.

       Old: A & B  returns B when A is True (excluded 0) else A
       New: A & B  returns 1 when A and B are True (includes 0)
                   returns ! when A or B is False (! instead of 0)
                   returns ? when one is True and the other Unknown

  o  Introduced conditional operators as replacement for
     prior feature of trinary logic operators returning
     the full range of true values.  Unlike the prior
     feature, these operators do not descriminate against
     zero which is now an additional True value.
       Old: A & B       returns B when A is True (excluded 0) else A
       New: A true B    returns B when A is True (includes 0) else A

  o  Introduced "Redefine" command.

       define r1 on(a and b);
       redefine r1 on(a or b);

  o  Introduced the terminology "node sentence" for the construct
     where arguments are passed to a node in a formula, assertion,
     or command. 


  o  Introduced node facets as part of a node sentence.


* Incompatibilities:

  o  When a rule term is referenced in a cell expression,
     the term no longer maps all true values to 1.  Instead,
     the value of the condition cell is returned.  This is
     to maintain consistency between rule references and
     simple cell references.  However, if you have a rule
     set that depends on rule terms returning 1 when true,
     you will need to modify your rules for them to work
     with this release or higher.

       define r1 on(a or b);
       define r2 on(r1=1 or c);  --> change this
       define r2 on(r1 or c);    <-- to this 

  o  A zero, "0", is no longer treated as False in logical
     operations.  Instead, a special symbol "!", is
     used to represet False.  This means every reference
     to "0" in rule files and check scripts must be
     replaced with "!".  References to "0" as a number,
     where there is no expectation that it be interpretted
     as False, need not change. This change, while
     disruptive, has a logical purpose which is described
     in the Features section below.

  o  When disabled terms are displayed using the show
     command, there are differences in the display
     (see Features below) that will cause check scripts
     prepared for prior releases to fail when using
     show commands on disabled terms.  You will need
     to modify these check scripts for use with 0.9.00
     and beyond.

  o  When a relational operator has a constant on the
     left and variable on the right the operands are
     reversed. This will cause check scripts using a
     show command for the condition to fail.  The solution
     is to update the check line starting with "~" to
     show the operands reversed:

       "a"=a   ==>   a="a"
       "a"<>a  ==>   a<>"a"
       "a"   a>"a"
       "a"<=a  ==>   a>="a"
       "a">a   ==>   a<"a"
       "a">=a  ==>   a<="a"

  o  Top glossary symbol changed from "@" to "_".  There
     has always been a mostly invisible root glossary
     named "_" and in prior versions a local glossary
     under it named "@".  This dates back to early versions
     where peers where understood by the interpreter and
     they each had a context name starting with "@".  That
     notion is obselete, so the local glossary named "@"
     has been elinated and the top glossary "_" is now
     visible in the way "@" used to be.  This means a
     show command will produce different output at the 
     top and check scripts must be modified.

	_ = # == node   [top node in show command now]
	@ = ! == node   [top node in show command prior]

  o  Term glossaries are now displayed in alphabetical
     order by the SHOW command.  This will cause check
     scripts created for prior versions to fail.  This
     can be resolved by reordering the check lines ("~")
     in the scripts.  

       > show -t

     Prior versions displayed terms based on how the
     glossary was organized.  By displaying them in
     alphabetical order, the display is easier to read
     and less likely to change in the future if the
     glossary is reorganized.

* New Features: 

  o  Cell evaluation in response to assertions has been
     accelerated in cases where a term is compared to 
     a constant.  The benefit of this acceleration depends
     on how many cells reference unique constants in
     comparison to any given term and the frequency of
     assertions to the referenced term. 

  o  Rules (on,when,if) now pass thru the value of the 
     condition when referenced, like a cell term.  Prior
     versions converted all true values to 1. This change
     ensure consistency when referencing named cells.  A
     rule condition is just a cell condition.

       define x cell a or b;
       define r1 on(x or y) c=2;
       define r2 on(r1); # reference to value of (x or y)

  o  A zero, 0, has joined with every other number and
     character string as a True value.  A "!" symbol is
     now used to represent False, just as "?" is used to
     represent Unknown.  While this is a break from the
     tradition of using 0 for false, it enables a value
     of zero to be handled constently with other values
     in logical expressions with handy side effects.  For
     example, we can define X to be A, or default to 10
     if A is False or Unknown.

       define X cell A | 10;

     If 0 is used to represent False, then X can never
     take on a value of 0.  By using a special False
     value represented by !, all numbers and character
     strings can pass through A to X.  Only A values
     of False (!) and Unknown (?) will cause X to default
     to 10.
     This applies to other logical operators the produce
     various True values.  In the following example, Y
     is 10 as long as A is True.  Now a value of 0 is
     just as True as every other number or string.  The
     value of Y only takes on the value of A when A is
     False (!), or Unknown (?). 

       define Y cell A & 10; 

     It feels strange to break from the tradition of
     using 0 to represent false, but within the context
     of NodeBrain logical operators, it would be less
     logical to maintain the tradition. 
  o  When disabled terms are displayed using the show
     command, the value of an enabled formula will now

       x = 5 == a+b           [x is enabled with value 5]
       x = # 5 == a+b   <<--- [x is disabled but a+b is 5]
       x = # == a+b           [x and a+b are both disabled]

     The last two examples above would display as follows
     under prior versions, indicating x is disabled without
     revealing the state or value of a+b.  Notice there is
     also a change from "!" to "#" as the indicator that the
     term is disabled.  This is because "!" is now the
     symbol for False.

       x = ! == a+b

  o  A new data type of "set" has been included.  This is
     an internal feature with some similarity to the Tree
     module.  The differences are:

       1) A set is one dimentional, while a Tree node is

       2) A set does not provide for association, while a
          Tree node does.

       3) A set can be used in symbolic substitution,
          while a Tree node can not.  This is only useful
          for small sets, since it is not practical to
          symbolically process large sets. 
  o  Operations on set cell types have been included. 
     This enables the addition of values to sets,
     evaluation to determine if a value is in a set,
     and removal of values from sets.

  o  The show command now supports a comma separated
     list of display options.

       > show a,b,c i,-r

  o  Event attribute terms starting with @ have been
     introducted for use with the ALERT command.  The
     value of these terms automatically resets to Unknown
     on the next alert to the same node, unless a value
     is assigned.

       alert @a=1,@b=2;
       alert @a=3;       // @b=?
       alert @b=1;       // @a=?

* Deprecated Syntax:

  o  The state transition time delay syntax of ~^1(...)
     and ~^0(...) is deprecated because 0 is no longer
     used to represent False. The prefered syntax is now

       ~^(...)   delay transition to True
       ~^!(...)  delay transition to False
       ~^?(...)  delay transition to Unknown

  o  The "not" operator has been deprecated to support
     a goal of not having any reserved terms.  Once it
     is dropped as a prefix operator (use ! instead),
     the term "not" can be used to name a cell.
  o  The @ symbol is deprecated a name for top context.
     Use _ instead.  Use of @ will cause a Warning message.

       define r1 on(@.a=1 or a=2);  // replace this
       define r1 on(_.a=1 or a=2);  // with this

* Dropped Syntax:

  o  The previously deprecated "address" command is no
     longer recognized to produce a hint to use ">"
     for interactive command prefix.

  o  The previously deprecated single quote for defining
     command prefixes no longer produces a warning.

  o  The previously deprecated syntax ~T(...), ~F(...), and
     ~U(...) for time delays has been dropped and no longer
     generates a warning message.

* Bug Fixes:

  o  Previously a sentence could be specified using a
     undefined term for the node.  The intent was to
     enable the node to be defined after referencing
     rules. However, the intepreter didn't allow the
     node to be defined later.  Although the term was
     automatically defined to be undefined, an attempt
     to define it as a node resulted in an error message
     saying the term was already defined.

     This bug has been resolved by requiring a node to
     be defined before it is used in a sentence.  This
     seems not to create any hardship.

  o  State transition time delays didn't work properly
     when multiple types of delays were placed on a
     common condition. This has been fixed.


NodeBrain 0.8.17 (Dopey) Change Summary

* Released August 13, 2014

* Theme: License Change

     This version is released under the MIT License or the
     NodeBrain License which is designed to be a combination
     of the MIT Lisense (Expat) and 2-clause BSD License.

* Documentation:

  o  All documents modified to identify new license.

* Incompatibilities:

  o  Line editing is now handled by libedit instead of
     readline.  This is only a build incompatibility. The
     new library provides the same functionality as the

* New Features: (none)

* Deprecated Syntax: (none)

* Bug Fixes: (none)


NodeBrain 0.8.16 (Dopey) Change Summary

* Released February 16, 2014

* Theme: Build Options

     This release is intended simply to provide the option
     to exclude OpenSSL related features and specified node
     modules from a build using ./configure --without-XXXX.

* Documentation:

  o  NodeBrain Guide converted to texinfo

  o  NodeBrain Guide includes build options (e.g. --without-tls)

  o  NodeBrain Language - Minor revision to SHOW command

* Incompatibilities: (none)

* New Features:

  o  Top level ./configure now handles lib and module
     configuration to shorten the time to configure.

  o  --without-tls may be used on ./configure command to
     exclude OpenSSL dependant features.

  o  --disable-nb_ may be used on ./configure to
     exclude the specified node module.

  o  The SHOW command now accepts a comma separated list
     of options.

* Deprecated Syntax: (none)

* Bug Fixes: (none)


NodeBrain 0.8.15 Change Summary

* Released May 25, 2013

* Theme: Packaging

     Cleaning up the packaging a bit before
     submitting to a couple Linux distributions.
* Documentation:

  o  %use directive added.

* Incompatibilities: 

  o  The directory where node modules are installed
     and searched for by default has changed.  If anyone
     installs custom node modules in the old default
     locations, they will not be found by this release
     of NodeBrain.  You can resolve this problem by
     setting the NB_MODULE_PATH environment variable.

  o  Modules are no longer loaded using the major version
     symbolic link created by libtool.  The module version
     numbers and symbolic links have been removed.

     New: /usr/lib64/nb-0.8.15/
     Old: /usr/lib64/nb/0.8/ -> ../

     You may still use version numbers on your node modules
     if you like, but the base symbolic link will provide
     access to your module instead of the .0 link.

* New Features:

  o  Debian packaging files are now included in a debian
     directory, and a prototype nodebrain.dsc file is
     included at the top level.  The digest in this file
     must be replaced when creating a debian package,
     since it can not be correct and be included within
     the original source file.

  o  Node modules are now installed to ${libdir}/nb-${version}
     instead of just ${libdir}/nb, and the minor
     version directory ${libdir}/nb/. and
     associated symbolics have been eliminated.  This change
     is intended to better enable the use of multiple versions
     of NodeBrain on a machine.

  o  Modules are no longer built with version numbers.  The
     path identifies the version.

  o  When installed using an rpm file built with "make rpm",
     the symbolic links produced by libtool for modules
     are no longer installed.

  o  The package was modified slightly to enable the --job
     make option for faster builds.

  o  The %{?_smp_mflags} macro is used to set the --job
     make option in an RPM build.

  o  ChangeLog files are created automatically from the
     source repository.

  o  The %use directive has been added.  It is similar to
     the %include directive and the source command, except:

	1) It sources the specified file at the top level
           context instead of the current context.
        2) It only sources the file if it hasn't already
           been sourced.
        3) It does not accept parameters.

     This is intended for files that provide a resource
     to other files. By including %use directives in
     files that require the resource, the high level
     files (e.g. an agent) is not required to know
     while resource files are required by the files it

* Deprecated Syntax: (none)

* Bug Fixes: 

  o  Some of the packaging "new features" identified above
     actually address deficiencies identified in by Jason
     Tibbitts in a Fedora package review, see Red Hat 
     Bugzilla Bug 592504.

  o  A bug was fixed in a translator function.  Previously
     references to undefined named subpatterns in regular
     expressions caused an array indexing error.

  o  A overlapping strcpy bug was fixed in function that
     handles line continuation.

NodeBrain 0.8.14 Change Summary

* Released February 11, 2013

     Versions 0.8.4 through 0.8.13 were not released.
     Although 0.8.3 software was released, the website
     was not updated with new documentation.

* Theme: Security Patches and Document Format

     Many security patches are included in this release
     and primary documents have been converted to texinfo.
     Although only a couple insignificant functional changes
     are included in this release, the features introduced
     in the 0.8.3 release will be new to most readers.

     See news below for NodeBrain 0.8.3.

* Documentation:

  o  Documents have been coverted from MS Word masters to
     Texinfo masters.
     Note: We anticipate switching from Texinfo to DocBook
     as the master format in the future. 

  o  The NodeBrain Module Reference has been replaced by
     individual texi manuals for each module.

* Incompatibilities

  o  The "greater than" (">") is now used instead of a single
     quote (') to set a command prefix in interactive mode.
     Use of a single quote was incompatible with the single
     quoted terms feature.  A command must be able to start
     with a single quoted term identifying a node.

  o  We messed up and broke binary compatibility with 0.8.3
     in 0.8.9.  Because documentation for 0.8.3 was not
     released and it had few downloads, we did not resolve
     this problem in 0.8.13.  We are treating 0.8.13
     effectively as the first real 0.8.x release.  The
     incompatibility is in the Message API introduced in

  o  The Webster module is changed since 0.7.4, requiring
     modification to configuration rules.

* New Fetures

  o  An nbkit command has been introduced to support
     NodeBrain kits provided by other packages.

  o  The ">" command replaced the single quote command
     for defining an interactive command prefix.

* Deprecated Syntax:

  o  None

* Bug fixes:

  o  A bug was fixed in an internal message queueing
     mechanism that malfunctioned when messages longer
     then 4K were queued.  This condition could occur
     when passing messages as input to a Servant node.

  o  Many security flaws were fixed.


NodeBrain 0.8.3 Change Summary

* Released September 6, 2010

     Versions 0.7.5 through 0.7.9 were not released.
     Versions 0.8.0 through 0.8.2 were not released.
     Actually 0.8.0 was released to SourceForge, but this
     release was not documented at
* Theme: Message Cabals and Statistical Anomaly Detection

     A NodeBrain message cabal is a set of nodes that
     broadcast messages to every node in the cabal.  The
     goal is to ensure rapid one-time delivery of each
     message to every other node in sequence for each
     originating node.  This enables a collection of
     NodeBrain agents to share a set of knowledge more
     efficiently and reliably than is possible using the
     peer module.

     Statistical anomaly detection capability
* Documentation:

  o  Message and Baseline modules have been documented
     in separate Texinfo files.

* Incompatibilities:

  o  None intended since 0.7.4
* New Features:
  o  Node modules may now implement commands independent
     of nodes using the following syntax.


     This is an alternative to a node module providing a
     utility skill and requiring the user to first create
     a utility node.

         define  node .utility;

     Either of these approaches is appropriate in cases
     where module specific commands are needed to configure
     a node module in some way (e.g. define keys for a
     communications module) or operate on files managed
     by a node module.

  o  Included the NodeBrain Message Cabal feature.  This
     provides a set of C API functions for reading and
     writing messages to a message log and sharing the
     content of a message log between nodes.  This is 
     intended as both a performance and functional
     enhancement over NodeBrain queues.  In addition to
     the API functions, a "message" module is included
     that implements the message cabal feature for
     NodeBrain commands.  Other modules may use the API
     to implement the message cabal feature for different
     types of messages.

  o  Statistical anomaly detection is supported by a new
     module, Baseline.  This module maintains two statistics,
     average value and average deviation, for any number of
     measures.  It alerts when values are outside of user
     defined limits expressed as a tolerance factor in units
     of sigma (standard deviation).

* Deprecated Syntax:

  o  None intended since 0.7.4

* Bug fixes:

  o  Cntl-D at command line crashed under 0.7.4 and was
     fixed in 0.7.5.

  o  Expression reduction error for xor and nor was fixed
     in 0.7.9.  Prior versions incorrectly reduced these
     expressions to the left expression.

  o  Expression reduction error for "not closed world"
     causing "![]a" to be reduced to "0" was fixed in


NodeBrain 0.7.4 Change Summary

* Released February 9, 2009 

* Theme: Nodes and Performance

     Since this is the first public release since
     0.6.4 and 0.6.5 in April of 2006, this is an
     accumulation of changes applied to multiple
     versions over this period.  We are restating
     these changes here to clarify, particularly
     since this version make obsolete several
     features that were only deprecated previously.

* Documentation:

  o  NodeBrain Tutorial has been expanded to include
     some distributed node modules.

  o  NodeBrain Tutorial has been converted to GNU Texinfo
  o  Other documents will be provided in PDF format only
     until converted to GNU Texinfo format.

  o  Many updates applied to support syntax changes.

* Incompatibilities:

  o  Symbolic substitution has changed.

  o  ADDRESS command replaced by single quote prefix

  o  In a DEFINE command, "listener" is replaced by various
     types of nodes.  New skill modules are included to
     provide the same functionality as deprecated listeners.

  o  In a DECLARE command, "brain" is replaced by a DEFINE
     command for peer node; that is, a node using the peer
     skill module.

  o  The PORTRAY command is replaced by an option of the
     peer skill module.

  o  The COPY command is replaced by the peer skill module.

  o  The >, / and \ commands are replaced by options of the
     peer skill module.

  o  In a DEFINE command, "file" is replaced by an audit node;
     that is, a node using the audit skill module.

  o  The PIPE command is replaced by the audit skill module.

  o  The CONSULT command is replaced by the - and = commands.

  o  The TRANSLATE command is replaced by the translator node

  o  The action priority is now called the action slice, and
     the polarity has changes.

  o  The IDENTIFY command is now a peer module command.
* New Features:

  o  Translator symbolic substitution supports alternate
     character replacement. 

  o  Translator feature now supports a hierachical syntax.

  o  New peer skill module replaces NBP and NBQ listeners
     and all related commands.

  o  New audit skill modules replaces LOG listener, FILE
     object type, and PIPE command.

  o  New pipe skill module replaces FIFO listener.

  o  New mail skill module replaces SMTP listener.

  o  Updated syslog skill module is ready for use.

  o  The Perl Compatible Regular Expression (PCRE) library
     is now used on Unix, Linux, and Windows.  We previously
     used the native regcomp and regexec functions on Unix
     and Linux and the rxspencer.dll from GnuWin32 on Windows.
     The and libraries are now
     prerequisits on Unix and Linux (see  For
     Windows, we distribute with NodeBrain a precompiled
     pcre3.dll and pcreprosix3.dll obtained from the GnuWin32
     project.  This change makes NodeBrain translator files
     portable across platforms and provides enhanced functionality
     and performance on some platforms.

  o  The GNU readline function is used on Unix/Linux to enable
     history and input editing.  We elected not to use this on
     Windows because history and input editing are natively
     supported.  It seems better for the user experience
     to match the platform in this case.

* Deprecated Syntax:

  o  In a DEFINE command, "node" replaces "expert".  This
     change was made with the hope that it would help users
     better visualize the structure of NodeBrain rules.

  o  The reqular expression match operator "~" replaces

* Bug fixes:

     Several bugs were fixed, created, and fixed.  They
     were not recorded and tracked properly to enable
     listing here.


NodeBrain 0.6.9 Change Summary

* Internal March 10, 2008

* Theme: Nodes and Performance

     Since 0.6.8 was not released to the open source
     project, the theme of this release is primarily 
     that of version 0.6.8---Nodes.  Version 0.6.9
     adds some internal changes that improve performance
     for applications with high transaction rates.  More
     performance enhancements are planned for future

* Documentation:

     Minor corrections to 0.6.8 document updates.

* Incompatibilities:

     None - see 0.6.8

* New Features:
     None - see 0.6.8

* Deprecated Syntax:

     None - see 0.6.8

* Bug fixes:


NodeBrain 0.6.8 Change Summary

* Internal August 5, 2007 

* Theme: Nodes

     This release is designed as a path to a planned
     release 7.0.  We are placing built-in functionality
     with skill modules where the functionality is not
     a central part of the interpreter.  This separation
     is intended to simplify enhancement via skill module
     substitution.  A node is now the object implemented
     by a skill module (prevously "expert"), and features
     previously built-in as "listeners" are now implemented
     by new skill modules.  In particular, the NodeBrain
     protocol (NBP) has moved to the peer skill module.  All
     commands related to NBP are now extended commands of
     the peer skill module.  You should now visualize a
     NodeBrain process as a collection of nodes that may
     interact with one another, and in some cases provide
     communication with external elements, including nodes
     within other NodeBrain processes.

* Documentation:

     All released documents have updates.  There are
     several syntax changes introduced in this release.
     Deprecated syntax is now undocumented, even though
     support continues until the next release.

* Incompatibilities:

     The ADDRESS command is no longer supported.  This
     was a feature used only in interactive mode, so no
     rule files should be impacted.  In interactive mode,
     the single quote (') special symbol command is now 
     used to establish a command prefix.  However, it
     differs significantly from the ADDRESS commmand.

* New Features:

  o  Translator symbolic substitution supports alternate
     character replacement.

  o  New peer skill module replaces NBP and NBQ listeners
     and all related commands.
  o  New audit skill modules replaces LOG listener, FILE
     object type, and PIPE command.

  o  New pipe skill module replaces FIFO listener.

  o  New mail skill module replaces SMTP listener.

  o  Updated syslog skill module is ready for use.

  o  The Perl Compatible Regular Expression (PCRE) library
     is now used on Unix, Linux, and Windows.  We previously
     used the native regcomp and regexec functions on Unix
     and Linux and the rxspencer.dll from GnuWin32 on Windows.
     The and libraries are now
     prerequisits on Unix and Linux (see  For
     Windows, we distribute with NodeBrain a precompiled
     pcre3.dll and pcreprosix3.dll obtained from the GnuWin32
     project.  This change makes NodeBrain translator files
     portable across platforms and provides enhanced functionality
     and performance on some platforms.

  o  The GNU readline function is used on Unix/Linux to enable
     history and input editing.  We elected not to use this on
     Windows because history and input editing are natively
     supported.  It seems better for the user experience
     to match the platform in this case.

* Deprecated Syntax:

  o  In a DEFINE command, "node" replaces "expert".  This
     change was made with the hope that it would help users
     better visualize the structure of NodeBrain rules.   

  o  In a DEFINE command, "listener" is replaced by various
     types of nodes.  New skill modules are included to
     provide the same functionality as deprecated listeners.

  o  In a DECLARE command, "brain" is replaced by a DEFINE
     command for peer node; that is, a node using the peer
     skill module.

  o  The PORTRAY command is replaced by an option of the
     peer skill module.

  o  The COPY command is replaced by the peer skill module.

  o  The >, / and \ commands are replaced by options of the
     peer skill module.

  o  In a DEFINE command, "file" is replaced by an audit node;
     that is, a node using the audit skill module.
  o  The PIPE command is replaced by the audit skill module.

  o  The CONSULT command is replaced by the - and = commands. 

* Bug Fixes:


NodeBrain 0.6.5 Change Summary

* Released April 20, 2006

* Theme: Servant Program Interface (Windows)

     This is essentially a re-release of 0.6.4 with fixes
     for defects discovered on Windows after 0.6.4 was
     release for Unix and Linux.

* Documentation:

     We are not releasing document updates with this 
     release.  Changes described in this file will be
     incorporated into the 0.7.0 document release.

* Incompatibiilties: 


* New Features;

  o  A "^" symbol may be used instead of ":" for sending
     messages to stdout.  Since we use ":" to override a
     remote prompt in interactive mode, we had no way to 
     send a message to the parent of a remote agent.  By
     using "^" instead of ":" you can avoid this conflict.
     We expect to deprecate and then drop support of ":"
     to send messages to stdout in future releases.

  o  The source file directive %include has been added as
     an alternative to the SOURCE command.  A directive
     seems more appropriate because the optional assertion
     following the file name is intepreted within the
     local context like other directives instead of the
     current command context.  

* Deprecated Syntax: 


* Bug Fixes

  o  The -d (daemon) option is now implied when running
     as a Windows service.  Without this fix a Windows
     service would stop after loading the configuration
     file if there were no "old style" listeners defined.

  o  A bug was causing NodeBrain to automatically restart
     under some conditions when running as a Windows
     service a and receiving a stop request.

  o  A console is now allocated when running as a service
     to enable management of servants as console groups.
     Without a console NodeBrain was not properly cleaning
     up servants when shutting down.

  o  When an expert was defined without a skill module
     and then referenced in an expert command, condition
     or assertion, the interpreter crashed with an 
     addressing exception.  This has been fixed. 

  o  Identifiers starting with "@." were not properly
     handled as a reference to the root context.  This
     has been fixed.

  o  The special case of ". " used for a context prefix
     was not recognized.  We now recognize it as a
     reference to the current context, which has no


NodeBrain 0.6.4 Change Summary

* Released April 1, 2006

* Theme: Servant Program Interface (Unix/Linux)

     This release introduces a new interface for extending
     NodeBrain functionality by writing "servant" programs
     or scripts in any language.  Using this interface a
     servant program communicates with NodeBrain using stdin,
     stdout and stderr.  This is a much simpler interface to
     use than the C API introduced in prior releases.

     Because this is new functionality, and because we have
     introduced some incompatibilities, this should not be
     treated as a patch release as the number would indicate.

* Documentation:

     Because of new features and incompatibilities we have
     updated the documentation.  We also elected to split
     the old NodeBrain User's Guide into multiple documents.

        NodeBrain User Guide
        NodeBrain Language Reference
        NodeBrain Module Reference
        NodeBrain API Reference

* Incompatibilities:
  o  The underscore ("_") may no longer be used within a 
     simple term.  For example, the following definition
     will produce an error message.

        define user_cpu cell 5;

  o  The -s option for nb is now used for the --servant
     instead of the --solve option.

  o  A verb may no longer be terminated by the symbols
     "(" or ":".  These terminators now cause a verb to
     be interpreted as a skill module extended expert
     reference.  The use of the "+" prefix for this purpose
     is now deprecated.

  o  Context prefixes without a trailing period are no
     longer supported and will be interpreted as a verb.
     When a command starts with an expert name, the name
     must be terminated with ".", "(", or ":".

* New Features:

  o  The "-" and "=" prefix commands are now called
     "servant" commands and support a more complete
     syntax.  For example, when these symbols are follows
     by a semicolon (":"), NodeBrain interprets the stdout
     of the child process as NodeBrain commands.

  o  A "+" is no longer required as a prefix when sending
     commands to a skill module extended expert.  The
     terminating symbol is now the differentiator between
     an expert reference and a verb.

  o  A servant module is provided for the definition of
     servants that accept commands on stdin.  Commands
     sent to experts extended by this skill module are
     forwarded on to the servant program.

* Deprecated Syntax: 

  o  The "+" prefix for referencing skill module extended
     experts is now deprecated.


NodeBrain 0.6.3 

     We elected not to release the 0.6.3 version, a patch
     release applied to the author's applications.


NodeBrain 0.6.2 Change Summary

* Released May 8, 2005

* Theme: API Cleanup

     In release 0.6.2 a new header (nbapi.h) is introduced
     to avoid exposing NodeBrain's internal structures
     to programs using the C API.  This should help
     programmers avoid dependence on NodeBrain internals
     and reduce the opportunities for API programs to break
     under new releases.  After all, that's one of the points
     of an API.  In addition, new API functions are included,
     more attentions has been given to using the API from a
     custom main routine, and it is now a bit easier to
     statically link extended skills into a program as an
     alternative to the preferred dynamic modules.

     Because there are few, if any, people programming skill
     modules at this point, it was decided to go ahead and
     create incompatibilities with the 0.6.1 API. 

* Documentation:

  o  Normally we don't plan to release document updates
     with patch releases.  However, we've slipped some
     enhancements and incompatibilities into 0.6.1 and 0.6.2
     that require document updates.  Rather than waiting to
     roll these into documentation for 0.7.0, we've elected
     to update the documentation with this release.

* Incompatibilities:

  o  We have changed the naming standard for skill binding
     functions in an expert skill module.

       INIT() changed to nbBind()
        changed to  Bind()

  o  Numerous changes where made to API function parameters
     and skill module API methods.

  o  A cache no longer creates terms for the threshold levels.


     We stopped doing this because there were few cases where
     it seemed useful to have the terms defined.  Now the values
     remain the same, but you have no access to modify these
     values.  If alternate values are required a translation 
     table can be implemented using a tree.  For example, you
     could use the following tree to translate them into numbers.        

        define myThreshold expert tree;
	myThreshold. assert ("normal")=0,("minor")=1,("major")=2,("critical")=3;

     This tree could be combined with a cache like this.

        define myCache expert cache:(a(3,6,9));
        myCache. define r1 if(myThreshold(a._hitState)>1);

     Another possibility for the future would be to support assignment
     of these values at skill definition time.  This is just hypothetical.
     We do not support this currently.

	define mycache skill cache:thresholds("ok","oops","ohmygosh","panic");
        define myCache expert mycache:(a(3,6,9));

* Bug fixes:

  o  SOURCE command supports quoted file names with spaces.
     This was required on systems that allow spaces in file

  o  Regular expressions are now supported on Windows with
     the help of the rxspencer.dll from the GnuWin32 project's
     "RegEx-Spencer" package.  Source code and updates are
     available at

* New Features: 

  o  The tree skill is now included in the NodeBrain 
     library (libnb.a) in addition to a dynamic module.

  o  The cache skill is now implemented using the skill
     module API although it is still statically linked
     into nb.

  o  A new WINDOWS command verb SHOWENV has been included.

       > windows showenv;

  o  New API functions have been included for skill module


  o  An environment variable NB_MOD_PATH may be used to
     assist NodeBrain in locating skill modules.  This is
     similar to the PATH environment variable.  Since
     NodeBrain uses the native interface for loading modules
     you may use platform specific environment variables
     to direct the loader.  The NB_MOD_PATH variable
     provides an "almost" platform independent method of
     specifying the directory search order for skill modules.
     The path separator is different on Windows from other
     platforms: ';' on Windows and ':' on other platforms.
     Here's an example where the variable is passed to nb
     on a Unix/Linux system.

       NB_MOD_PATH=".:/tmp" ./nb mytest.nb
  o  You may now specify a path with multiple directories
     when declaring a module. 

       declare tree module {".:/tmp"}tree;
     This syntax is preferred even when you only specify
     one directory, because it allows NodeBrain to construct
     the file name for you, causing your rules to be more        
     platform independent.

       declare tree module {"/tmp"}tree; # This is preferred
       declare tree module "/tmp/"; # over this

     If you know your rules will be used on only one platform,
     you may actually prefer the second line above because it
     is easier to read.  You have a choice.  But the first line
     above is easier to modify to add more directories later
     and you never know when you may want to port rules from
     Linux to OS X.

* Experimental Features:

  We refer to these features as "experimental" because we
  are introducing a "preliminary implementation" that is
  likely to undergo refinement relatively quickly.  In
  other words, the design is unstable.

  o  Internet Protocol (IP) API functions for skill
     module development


  o  Stream API functions for skill module development


  o  Translation API functions


  o  Console skill module

     When NodeBrain runs as a monitoring agent there are
     two major functions that require a user interface:

       1) rule configuration, and
       2) visibility of the state of monitored elements.

     In prior releases we have been content to rely on
     existing user interfaces for these functions.  For
     example, an SSH client can be used with VI to edit
     rule configuration files and an email inbox can be
     used as an alert viewer.  The NodeBrain interpreter,
     nb, is itself a line mode client that can be used
     for remote configuration of an agent, and for
     viewing the internal state of rule conditions.
     However, for some applications of NodeBrain, it
     seems that a graphical user interface (GUI) will be
     more appropriate.  Although we didn't plan to
     entertain this notion in a 0.6.x release, we have
     decided to build a console GUI to support an
     application that uses one of our private Expert
     Skill Modules.  We have generalized the required
     enhancements to nb by extending the Expert Skill
     Module API.  The prototype NodeBrain Console itself
     is a Java application that will be released as a
     separate package.

  o  Other skill modules

       netflow   - worm detection
       snmptrap  - V1 SNMP Trap monitor
       syslog    - remote syslog monitor (UDP port 514)
       translate - execute NodeBrain translation rules

* Deprecated Syntax: 

  o  Enhancements to the module declaration syntax make
     it unnecessary to support the ".?" wild character
     in module declarations and this is now deprecated.

       declare fred module /tmp/nb_mod_tree.?;  (old)

       declare fred module {"/tmp"}tree;        (new)
       declare fred module nb_mod_tree.?;       (old)

       declare fred module tree;                (new)

     It is no longer necessary to declare installed
     modules with matching skill and module names
     when you reference them by this name.

       # This declare is unnecessary. 
       declare mymod module /usr/local/lib/nb/; 
       # NodeBrain will find the installed module.
       define mystuff expert mymod(1,2,3);

     If the skill and module names don't match, you can
     still avoid the module declaration for install modules.

       define mystuff expert mymod.stuff(1,2,3);

  o  It is no longer necessary to enable experts that
     use skill modules (e.g. snmptrap) that listen.  These
     modules will now enable automatically when NodeBrain
     becomes a daemon/service.

       define snmptrap expert snmptrap;
       enable snmptrap; # don't need this to start listening

     Once in deamon/service mode, you may elect to disable
     and enable a listening expert.  It just isn't necessary
     to enable it the first time.

  o  The syntax for cache definitions has changed slightly.

       define processes expert cache(~(h):parent,child);  (old)
       define processes expert cache:(~(h):parent,child); (new)

     This is necessary to get the old built-in cache feature
     to conform to the syntax for experts.

       define  expert [(arglist)][:text]

     NodeBrain parses everything up to the text, and the skill
     module parses the text.  For compatibility with existing
     rules, the interpreter still recognizes cache as a special
     case and will pretend the ":" was coded after cache.  An
     warning message is produced to encourage an update to the
     rules.  The deprecated syntax will be an error in some
     future release.

* Packaging:

  o  A Microsoft Installer (nb.msi) file is now provided
     to support installation on Windows following native
     customs that support Add/Remove.

  o  A Windows help file has been included in the Windows
     binary distribution.


NodeBrain 0.6.1 Change Summary

* Released October 11, 2004

* Theme: Cleaning up bits and pieces.

     As a patch release, there is no one grand theme
     here.  However, there are small enhanecments and
     some bug fixes that I found useful in my own
     applications.  For my own purposes, this release
     has been more reliable than 0.6.0.

     What's Next?

     Starting to look forward to a 0.7.0 release.  My
     current plan is to focus on three things.

       1) Systematic testing
       2) Sample application(s)
       3) Skill module enhancements

     Better testing is needed to achieve the level of
     reliability needed before going to a 1.0 version.
     It works fine now for my own applications, but I
     use it the way it works.  It needs to be more 
     graceful in responding to the random command syntax
     a new user might try.  And at least one complete
     sample application is needed to get people started. 
* Documentation:

  o  At the time of this release, the "NodeBrain User's
     Guide" has not been updated to reflect changes in
     this release.  When updated, the document will be
     posted on the website,  A document
     release file will be posted on the SourceForge
     project page.  Please use the online 0.6.0 document
     for now.

* Incompatibilities:

  o  Nested symbolic substitution for generating terms,
     ${{a}{b}}, is no longer supported.  This feature
     had little merit and conflicted with our desire to
     support symbolic substitution using cell expressions.

  o  Expert skill module compute() methods are now   
     expected to return a grabbed cell.  It is unlikely
     anyone out there has dabbled with writing skill
     modules yet.

  o  Rule actions are no longer performed when a rule
     condition changes after the action is scheduled.
     When a change causes multiple rules to fire, the
     action of one rule may change the condition of
     another.  If this happens, NodeBrain now considers
     it unsafe to perform a scheduled action whose
     condition has changed.  This is because actions
     often use terms within the condition as parameters.
     An "action priority" option has been included to
     help avoid this situation.

* Bugs Fixed:

  o  Multiple bugs related to releasing of objects.

  o  Corrected the order of symbolic substitution and
     reduction.  This does not impact commands injected
     by rules, but does resolve a problem for user
     entered commands starting with a reduction ("$ ").

  o  Eliminated unnecessary pass through symbolic    
     substitution logic for rule action commands that
     don't need it. Check is made at rule definition time 
     now instead of every time the command is parsed.

  o  Symbolic reduction "$  $${..}" to "${..}" is done
     for rule action commands at rule definition time 
     now.  Stopped doing every time the command is parsed.

  o  Rules are no longer allowed to fire more than once
     in a given command cycle. This was documented but 
     not implemented prior to this release.
  o  Fixed bugs related to the use of rule terms in cell
     expressions.  A rule term may be used as a name for
     the rule condition cell.  Notice r1 in this example.

       define r1 on(a=1 and b=2):-echo hi
       define r2 on(r1 or c=3):-echo ho

  o  Fixed bugs in the "solve" command.  The solve
     command may now be used multiple times in the
     same context.  State changes may cause "solve"
     to resolve previously unresolved terms. You may
     also assert terms to be unknown, causing solve
     to resolve them again if necessary. 

  o  The "show" command reveals context a little better.
     A context prefix is included when rules are displayed,
     unless the context matches the current context.  When
     a context terms is shown, it is reduced to ".".  A
     period may also be used as an abbreviation in the show
     command.  > show .

  o  The new form of cache assertion introduced in 0.6.0
     was not properly reacting when a threshold was hit.
     The has been fixed, but the fix introduces an 
     unfortunate inconsistency in the assert command. As
     "fixed" the following example will cause rFirst to
     fire twice, once for 1, and once for 2.

        define johnny expert cache(~(5m):x(1));
        johnny. define rFirst if(x._hitState);
	define rAssert on(a=1) johnny(1),johnny(2);
     For the moment, I've designed myself into a corner
     here.  Previously we have said that all assertions
     in a given command are applied "concurrently" and
     then rules respond to the collective assertion.
     However, when a cache hits a threshold it forces
     an immediate response.  This means the assertions
     on a single command are no longer "always" applied
     "concurrently".  Here is an example of a situation
     that violates our promise of "concurrent" assignment.

	define c expert cache(x(1));
	define r1 on(a=1);
	define r2 on(a=2);
	define r3 on(a=3);
	assert a=1,c(1),a=2,c(2),a=3,c(3);
     In this case, r1, r2, and r3 all respond because
     c(1), c(2), and c(3) all hit a threshold and force
     an immediate reaction.  Had the assertion been as
     follows, only r3 whould fire.

        assert a=1,a=2,a=3;

     In this example, it almost seems like a good thing.
     But, when we change the rules a bit, the problem
     is exposed.  Rules r1 and r2 both fire instead of
     just r2.

        define c expert cache(x(1));
	define r1 on(a=1 and b<>2);
	define r2 on(a=1 and b=2);
        assert a=0,b=0;
	assert a=1,c(1),b=2;

     For now we need to be aware of this and avoid coding
     rules that are sensitive to this problem.  In practice
     it will not be difficult to avoid it, but I'm not
     comfortable with this as a final solution.

* New Features:

  o  Symbolic substitution supports cell expressions

       define r1 on(a=1) x=${trouble(y)*10+3}

  o  Show command supports cell expressions enclosed
     in parentheses as alternative to a term.

       show () [

Copyright © 2015