In message <aanlkti=v0mgh3iascgjwezfp0bljzmzwd0juobdps...@mail.gmail.com>,
Joe Prosser writes:
>I was wondering if there was a way to dynamically create context definitions,
Well you can create contexts on the fly by having SEC read from a
control channel (file or fifo) and applying a rule to only that
channel that will create/delete/obsolete contexts on the fly. There
should be some examples of suitable rules in the SEC mailing list
archives (maybe try searching for rouilj and control channel).
>I would like to not have to create the config file but rather generate
>the specification on the fly.
Creating entire rules rather than just contexts is a little different.
The best you can probably do is start SEC with an empty rules file,
and write your rules to that file. Then send a SIGABRT/SIGIOT (soft
reload) to reload the rules file. Note any existing correlation
operations (pair, pair with window ....) that were associated with
that file will be cancelled.
I am not sure if you can use -input="*.sr" and add a file on the
fly. That would let you add new rules to a new file and soft reload it
which shouldn't affect any ongoing operations.
If you wanted to remove a rule from an existing file, you could use a
unique context value for every rule and dynamically set/delete the
context rather than rewriting the file and removing the rule.
E.G.
type = single
...
context = !disable_this_rule_1
...
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
This SF.net email is sponsored by
Make an app they can't live without
Enter the BlackBerry Developer Challenge
http://p.sf.net/sfu/RIM-dev2dev
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
