Hi Risto,
This helps me a lot!
Thank you very much for your help.
Dusan
Od: Risto Vaarandi <risto.vaara...@gmail.com>
Odoslané: 20. apríla 2017 15:52:56
Komu: Dusan Sovic
Kópia: simple-evcorr-users@lists.sourceforge.net
Predmet: Re: [Simple-evcorr-users] Regexp matching against context names
hi Dusan,
the post you are referring to originates from 2012 when the most
recent sec version was 2.6.2. This version didn't indeed have support
for looping in action lists. While 2.7.X versions do not have a
specific action for regular expression based filtering of context
names, it can be done in a straightforward way with 'lcall' action.
For example:
lcall %names -> ( sub { grep(/^MY/, keys %main::context_list) } )
The above action takes advantage of the fact that context names act as
keys in the %main::context_list hash, and uses a simple grep(/regex/,
...) filter for extracting all relevant names. I would argue that
using 'lcall' instead of a 'findcont' action allows for more generic
filtering, since you can define more complex conditions inside a Perl
code snippet that just one regular expression.
Also, here is an example how to use the above action for actual deletion:
type=single
ptype=regexp
pattern=create (\S+)
desc=set up context $1
action=create $1
type=single
ptype=substr
pattern=delete
desc=find context names
action=lcall %names -> ( sub { grep(/^MY/, keys %main::context_list) } ); \
fill BUFFER %names; getsize %n BUFFER; \
while %n ( shift BUFFER %context; delete %context; getsize %n BUFFER)
If you start up sec with this rule and feed in events
create AAA
create BBB
create CCC
create MYCONT1
create MYCONT2
then five contexts AAA, BBB, CCC, MYCONT1 and MYCONT2 are created by
the first rule. If you feed a line to sec that contains the string
"delete", the second rule uses regular expression ^MY to find out
contexts with prefix "MY" and deletes them. In the case of above five
contexts, MYCONT1 and MYCONT2 get deleted.
In order to accomplish deletion in the while-loop, context names are
pushed into the event store of the context called BUFFER, and the body
of the loop gets executed until all context names have been consumed
for BUFFER. During each iteration, the first name from the event store
of BUFFER is taken away with the 'shift' action, deleting the context
with that name. After that, the number of remaining names is
established with the 'getsize' action, and if getsize returns 0, the
loop terminates.
Hope this helps,
risto
2017-04-20 12:51 GMT+03:00 Dusan Sovic <dusan.so...@hotmail.sk>:
> Dear mailing list users,
>
> I would like to know if there is a possibility or plan to support regular
> expression matching against context names.
> In my case sometimes it can be useful to have option to delete all contexts
> matching given regexp pattern like 'delete device01.com.*'.
> Contexts what I creating contains device FQDN and additional information so
> for one device I can have one or more contexts created 1:N.
>
> Example:
> Context Name:
> device01.com|H3C-LAGG-LAGG_INACTIVE_PARTNER|Ten-GigabitEthernet1/0/7-BAGG57
> Context Name:
> device01.com|H3C-LAGG-LAGG_INACTIVE_PARTNER|Ten-GigabitEthernet1/0/8-BAGG58
>
> In the past this topic was discussed in this post:
> https://sourceforge.net/p/simple-evcorr/mailman/message/30011331/ and Risto
> proposed to create "action 'findcont %o regexp', that would allow for
> creating repeated actions over data in variable %o."
>
> Thanks and Best Regards,
> Dusan
>
> --
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> ___
> Simple-evcorr-users mailing list
> Simple-evcorr-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot___
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
