Many thanks Tim I am beginning to understand the internal_events a little better.
How can I tell SEC to monitor a new log at midnight if some of the logs monitored are in the form of logname_YYYMMMDDD.log? Best regards ben -----Original Message----- From: Tim Peiffer [mailto:[EMAIL PROTECTED] Sent: Friday, December 05, 2008 2:32 PM To: Hayward, Ben Cc: [email protected] Subject: Re: [Simple-evcorr-users] Two questions Hayward, Ben wrote: > > Hi Group, > I would like to have a log of SEC termination and was thinking > that internal events would be the best method. > How can I use internal events to log SEC termination ? > How can I tell SEC to use next colander day for logs that are in > logname_YYYMMDD.log format > > Ben, Use the -intevents option on the command line, and add a rule that uses a SEC_INTERNAL_EVENT context and a pattern of SEC_SHUTDOWN as an event. sec.pl -detach -conf=<config> -input=<input> ... -intevents sec,cfg type=Single desc=Set variables and things on shutdown of sec (core) ptype=RegExp pattern=SEC_SHUTDOWN context=[ SEC_INTERNAL_EVENT ] action=logonly It is a cold cruel world. Tim Peiffer Network Support Engineer Office of Information Technology Univiersity of Minnesota/NorthernLights GigaPOP > Thank you all in advance > > > ben > > ---------------------------------------------------------------------- > -- > > ---------------------------------------------------------------------- > -------- SF.Net email is Sponsored by MIX09, March 18-20, 2009 in Las > Vegas, Nevada. > The future of the web can't happen without you. Join us at MIX09 to > help pave the way to the Next Web now. Learn more and register at > http://ad.doubleclick.net/clk;208669438;13503038;i?http://2009.visitmi > x.com/ > ---------------------------------------------------------------------- > -- > > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > -- Tim Peiffer Network Support Engineer Office of Information Technology University of Minnesota/NorthernLights GigaPOP ------------------------------------------------------------------------------ SF.Net email is Sponsored by MIX09, March 18-20, 2009 in Las Vegas, Nevada. The future of the web can't happen without you. Join us at MIX09 to help pave the way to the Next Web now. Learn more and register at http://ad.doubleclick.net/clk;208669438;13503038;i?http://2009.visitmix.com/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
