Is there a way to make a window a variable in a "SingleWithSuppress" rule?
I'd like to make the rule "window=" parameter below a variable... where I could
plug in the window-value via code.
I can accomplish what I want with multiple rules, but was just wondering if
there is an easier way.
What I'd like to be able to do... is setup different window values for
different event classes... as the events came in.
Is it possible to have something like window=%mySubReturn (or ???).
Thanks.
Gary Boyles, Intel
type=SingleWithSuppress
continue=TakeNext
ptype=RegExp
pattern=(\d+)\s+::\s+(\S+)\s+::\s+(\S+).*$
context=($3) -> ( sub { \
if ( defined $dup_detect_class_1800{$_[0]} ) { return 1; } \
else { return 0; } } )
window=1800
desc=dup_detect_class_1800_seconds_and_go::$2::$3
action=write /sec/log/sec.main.log %u %s
------------------------------------------------------------------------------
LogMeIn Central: Instant, anywhere, Remote PC access and management.
Stay in control, update software, and manage PCs from one command center
Diagnose problems and improve visibility into emerging IT issues
Automate, monitor and manage. Do more in less time with Central
http://p.sf.net/sfu/logmein12331_d2d
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
