What's difference between libhs.so and libhs_runtime.so

[crazy-william]

What's difference between libhs.so and libhs_runtime.so, and when will we use the latter?

[mdb256]

The short answer is that most users won't use libhs_runtime.

The runtime lib is the subset of the Hyperscan library required for scanning data, without the functionality for compiling patterns. That is, it doesn't contain hs_compile()/hs_compile_multi() or any of the support functions listed in hs_compile.h.

This means that to use the runtime lib, a pattern database would need to be compiled by a program linked to the full libhs, the pattern DB serialized, the DB moved/stored, and then deserialized by the program linked to libhs_runtime. For example, you might have a central service that compiles pattern databases which then sends the serialized DB out to a set of machines that use the HS runtime to scan network traffic.

As for the why: the runtime lib is obviously smaller than the complete library, but the main reason for its existence is that the runtime shared lib doesn't require libstdc++.so (or equivalent C++ runtime) - the HS runtime is entirely written in C, whereas the HS compiler is C++. So in the above example, Hyperscan doesn't require that the set of machines scanning network traffic have an installed C++ runtime.

[crazy-william]

thank you for your so detail answer.
Then Would you please tell me how to export compiled pattern DB? I don't find API to do this work.

[mdb256]

We have API calls for serializing and deserializing the compiled pattern DB.

Serializing flattens the database into a sequence of bytes (with a length) that can be written to a file, or sent over a network connection, and then deserializing takes those bytes and turns them back into a database. Handling files and network connections is outside of the scope of the Hyperscan library.

[crazy-william]

Thank you so much. I have no other question. You can close it.