I need to report if there is greater than 3 successful logins for a given
account within 45 seconds. I have read over the pm_evcorr section of the
documentation and now I'm confused. I have tried the following configuration
and it resulted in two logs with the same information in both of them - 1
log has everything the other I only want the successful logins to be written
to. Part of my confusion comes from the 'Condition' statement, when I used
'$Message =~ /An account has successfully logged on/' I received an error
but when I used '$Message =~ /^thresholded/' I received no errors. (I have
only included the section of the configuration that deals with pm_evcorr -
if it would help to clarify anything I can include the rest of the
configuration)

<Processor wfscpkicas-evcorr>
       Module          pm_evcorr
       <thresholded>
                # if the number of events exceeeds the given threshold
within the interval do the Exec
                # Same as SingleWithThreshold in SEC
               Condition       $Message =~ /^thresholded/
               Threshold       3
               Interval        45
       </thresholded>
</Processor>

<Output wfscpkicas-evcorr-out>
       Module         om_file
       CreateDir      true
       Exec            to_syslog_bsd();
       Exec            $raw_event =
"---------------------------------------------------------------------------
----\n" + $raw_event;
       File            '%WEBTRUST%/' + $Hostname + '/' + $Hostname +
'-events.log'
</Output>

-----Original Message-----
From: Botond Botyanszki [mailto:b...@nxlog.org] 
Sent: Monday, January 06, 2014 3:25 AM
To: nxlog-ce-users@lists.sourceforge.net
Subject: Re: [nxlog-ce-users] pm_evcorr information

Hi,

Can you elaborate on what exactly "correlate X number of successful logins
in a given time" means?
For example you want to have all successful login events for each user
merged into a new event every N seconds or you want to alert/log if the user
login count exceeds X over a specific interval?
See the Thresholded rule in pm_evcorr for the latter.

Regards,
Botond



On Fri, 3 Jan 2014 11:27:57 -0700
"Paul Fontenot" <ssdv6...@gmail.com> wrote:

> I've read over the pm_evcorr information at nxlog.org and am a little 
> confused. Can anyone point me in the direction of an example (web page 
> is
> fine) of how to correlate X number of successful logins in a given 
> time frame?
> 
> 
> ----------------------------------------------------------------------
> -------- Rapidly troubleshoot problems before they affect your 
> business. Most IT organizations don't have a clear picture of how 
> application performance affects their revenue. With AppDynamics, you 
> get 100% visibility into your Java,.NET, & PHP application. Start your 
> 15-day FREE TRIAL of AppDynamics Pro!
> http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.c
> lktrk _______________________________________________
> nxlog-ce-users mailing list
> nxlog-ce-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users

----------------------------------------------------------------------------
--
Rapidly troubleshoot problems before they affect your business. Most IT
organizations don't have a clear picture of how application performance
affects their revenue. With AppDynamics, you get 100% visibility into your
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics
Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
_______________________________________________
nxlog-ce-users mailing list
nxlog-ce-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users


------------------------------------------------------------------------------
Rapidly troubleshoot problems before they affect your business. Most IT 
organizations don't have a clear picture of how application performance 
affects their revenue. With AppDynamics, you get 100% visibility into your 
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk
_______________________________________________
nxlog-ce-users mailing list
nxlog-ce-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users

Reply via email to