Jeroen Scheerder wrote: >> Bottom line- I don't think it's possible. But others may have a >> better idea... > > Thanks again. I think it's tricky, but am not yet convinced it's > impossible and will try to experiment a little. If I do, I just might > be able to add an "use timestamp from logfiles" option that entails > "notail". :-) > > Regards, Jeroen.
it all depends on the functionality you want, but you certainly won't get the full functionality. As Jim mentioned, having a contiguous notion of time that comes from the system clock is important. E.g., the 'event' action could submit an event not immediately, but after N seconds. Suppose now that one of your messages has a timestamp 10:32:20 which triggers the 'event' action, but the next line in your log file has a timestamp of 11:32:20. If N is less than 3600, you have missed an input line which might have triggered another event correlation operation and possible action as a result. The same example can be easily extended to contexts -- they may become obsolete and trigger actions without any lines appearing in the input. Or take the Calendar rule which reacts to system clock only -- it can do its work without seeing anything in the input for months. Even if you have something in input and move the clock forward for more than a minute, you might already miss some actions that would have otherwise been executed from the Calendar. In short, the issue is not trivial and requires thorough revision of the code. br, risto ------------------------------------------------------------------------------ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
