In message <4dff2088.4030...@ac-nancy-metz.fr>,
Ludovic Hutin writes:
>Le 17/06/2011 15:49, John P. Rouillard a écrit :
>> In message<4dfb547b.3080...@ac-nancy-metz.fr>,
>> Ludovic Hutin writes:
>>> I am back again, with another question, it's possible to set the
>>> context param to be case insensitive ?
>>> In my first log, username come in lowercase, and into other log
>>> they come with some uppercase
>>>
>>> context=USER_$13 with $13 in the first logs is "toto" and in the
>>> second log is "TOTO"
>>> The result is simple, impossible to correlate the 2 entry :-(
>> The only thing that comes to mind immediately is to use a perlfunc for
>> the pattern and modify the case of the username. Something like:
>>
>> ptype = perlfunc
>> patterm = sub { if ( $_[0] =~ /(your) pattern with (NAME) (here)/ ) { \
>> return ($1, lc($2), $3); } else { return 0;} }
>> context = name_$2
>I can say this solution works perfect. But now, i got a not easy
>configuration file ;)
Yes, you will definitely want to document what this rule does and why
it is needed. I am guessing the systems you are working with use case
insensitive usernames so TOTO and toto are both the same user. So it
is a bit of a tricky correlation issue as well.
Also for other seeing this thread in the mailing list, one other way
of handling it would have been to preprocess one of your logs using
something like sed or perl to convert your uppercase names to
lowercase (or the lowercase to uppercase). But this moves some of the
complexity outside of SEC which may or may not be desirable.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
EditLive Enterprise is the world's most technically advanced content
authoring tool. Experience the power of Track Changes, Inline Image
Editing and ensure content is compliant with Accessibility Checking.
http://p.sf.net/sfu/ephox-dev2dev
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
