On Thu, 13 Sep 2012, John P. Rouillard wrote: > Hi all: > > I have the following setup: > > ruleset 01 does some processing > > ruleset 05 has a jump rule in it that jumps to the END cf set > > (rules to spit out new event and clear some contexts) > > type= jump > continue = dontcont > desc= Skip all processing for slapd > ptype= regexp > pattern= \.example\.com slapd\[[0-9]+\]: > cfset = END > > ruleset 10, 15, 30....99reset are the additional rules that I expect > the jump to skip for the matching event. > > ruleset 99zzend adds the ruleset to the END cfset. > > type = options > joincfset = END > procallin = no > > type = single > desc = log > ptype = regexp > pattern = .* > action = write - triggered 99zzend.sr $0 > > What I am expecting for an input line of: > > foo.example.com slapd[2345]: something > > is to take the jump rule, branch to 99zzend and stop processing that > event. But what I am seeing (from an instrumented version of SEC > 2.6.2) is: > > Added line foo.example.com slapd[2345]: lslsls from input as new event > Applying rule: 0 from 01control.sr > Tvalue application true in 1.7e-05s > Applying rule: 0 from 05EventResetDispatch.sr > (*log new event to stdout rule > Applying rule: 1 from 05EventResetDispatch.sr > Regexp application in 3.1e-05s > Writing event 'new event foo.example.com slapd[2345]: lslsls' to file - > (* logged devent to stdout stdout) > new event foo.example.com slapd[2345]: lslsls > Applying rule: 2 from 05EventResetDispatch.sr (* slapd match rule above) > Regexp application in 2.8e-05s > (* jump has occurred as expected) > Applying rule: 0 from 99zzend.sr > Regexp application in 2e-05s > Writing event 'triggered 99zzend.sr foo.example.com slapd[2345]: lslsls' to > file - > triggered 99zzend.sr foo.example.com slapd[2345]: lslsls > > (* now it looks like it is going through all the rest of the rule > files in order.)
I think that a Jump should be viewed as a gosub with an implicit return, not as a goto. i.e., it's a way to bundle a bunch of rules togeather and only process them if another rule fires, not as a way to skip rules. David Lang ------------------------------------------------------------------------------ Got visibility? Most devs has no idea what their production app looks like. Find out how fast your code is with AppDynamics Lite. http://ad.doubleclick.net/clk;262219671;13503038;y? http://info.appdynamics.com/FreeJavaPerformanceDownload.html _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
