$MAINPID
User=root
[Install]
WantedBy=multi-user.target
--sk
From: Risto Vaarandi [mailto:risto.vaara...@gmail.com]
Sent: Saturday, August 05, 2017 8:16 AM
To: Stuart Kendrick
Cc: simple-evcorr-users@lists.sourceforge.net
Subject: Re: [Simple-evcorr-users] look-up a string in a hash, then write
Thank you for tip; I have implemented it
--sk
From: Risto Vaarandi [mailto:risto.vaara...@gmail.com]
Sent: Monday, August 07, 2017 2:29 PM
To: Stuart Kendrick
Cc: simple-evcorr-users@lists.sourceforge.net
Subject: Re: [Simple-evcorr-users] look-up a string in a hash, then write hash
value
2017-08-05 18:15 GMT+03:00 Risto Vaarandi :
> hi Stuart,
>
...
>
> For initializing the %arrayid_to_lnn hash, I have used the following rule
> from one of your previous posts:
>
> # Global variables
> type=Single
> ptype=SubStr
> pattern=SEC_STARTUP
> context=SEC_INTERNAL_EVENT
> desc=initializ
hi Stuart,
I have tried out your ruleset with the test event you have provided, with
/home/tocops/.tocpipe replaced with - (standard output). I have found no
issues with the ruleset and it works as expected:
sec --conf=stuart.sec --input=- --intevents
SEC (Simple Event Correlator) 2.7.8
Readin
l go back and fix this.]
--sk
From: Risto Vaarandi [mailto:risto.vaara...@gmail.com]
Sent: Friday, August 04, 2017 1:01 PM
To: Stuart Kendrick
Cc: simple-evcorr-users@lists.sourceforge.net
Subject: Re: [Simple-evcorr-users] look-up a string in a hash, then write hash
value
I create a rule which u
>
> I create a rule which uses %arrayid_to_lnn to translate Array ID into LNN
>
>
>
> # Handle Isilon node down messages
>
> type=SingleWithSuppress
>
> ptype=regexp
>
> pattern=T(\d\d:\d\d:\d\d)\-\d\d:\d\d (.*?) .*gmp.info.c.* group change:.*
> (node \d+ drive \d+ changed to up)
>
> desc=Drive Rec
rule files
and then watch the output – in the example above, I want to print the value of
$arr
--sk
From: Risto Vaarandi [mailto:risto.vaara...@gmail.com]
Sent: Tuesday, July 25, 2017 2:47 PM
To: Stuart Kendrick
Cc: simple-evcorr-users@lists.sourceforge.net
Subject: Re: [Simple-evcorr-users] look-
One additional remark -- when you don't return any value from a Perl
subroutine explicitly with the 'return' statement, Perl always returns the
value of the last regular statement. So instead of "return 1;" in the
previous example, writing just "1;" would produce the same effect.
hth,
risto
2017-0
2017-08-03 16:40 GMT+03:00 Stuart Kendrick :
...
>
>
> But this is fine – a classic challenge, which sec is prepared to meet.
>
>
>
> So, I created a global hash using SEC_STARTUP / SEC_INTERNAL_EVENT
>
>
>
> # Global variables for Isilon
>
> type=Single
>
> ptype=SubStr
>
> pattern=SEC_STARTUP
>
--sk
From: Risto Vaarandi [mailto:risto.vaara...@gmail.com]
Sent: Tuesday, July 25, 2017 2:47 PM
To: Stuart Kendrick
Cc: simple-evcorr-users@lists.sourceforge.net
Subject: Re: [Simple-evcorr-users] look-up a string in a hash, then write hash
value
hi Stuart,
you are on the right track and t
Hi,
I did another approach. I hope help you or another one in the group.
Log example.
2017-07-25T04:31:10-07:00 server-foo … down: 1 ….
2017-07-25T04:31:10-07:00 server-foo … down: 2 ….
2017-07-25T04:31:10-07:00 server-foo … down: 3 ….
Rule:
type= Single
ptype = regexp
pattern = .*dow
hi Stuart,
you are on the right track and the PerlFunc pattern in your rule properly
maps the integer into a string. As explained in the documentation section
of different pattern types (see http://simple-evcorr.github.io/man.html#lbAG),
return values from the PerlFunc pattern function initialize
12 matches
Mail list logo
