Hi, i need to make a persistance correlation and i´m not sure if SEC can help me. It should goes like this:
I receive traps with a determinate OID in a log file as raw data, then i write the output to a DB to show it later as an alarm. I want to show the first coincidence and i want to correlate the event to show only when its a change in the trap during a time threshold and if there´s a change in that same event, reset that time threshold and of course show the changes. I prefer do it in memory and not in DB... Well, is it possible to do that with SEC? and if yes... HOW??? maybe using several rules in the same conf file?? thanks in advance
------------------------------------------------------------------------------
_______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
