Yes, that is exactly what I'm trying to do... use a template of rules, and then
hash-arrays to define when to use those rules.
For example, here are the two rules I use for duplicate-detection for any
node+monitor pair implementing a variable window.
In this case the %dup_detect hash uses node::monitor for key, and seconds for
value.
I then can have variable-window duplicate-detection for any node+monitor using
just 2 rules.
I was just looking for some other method for "PairWithWindow".
#========================================
# Rule_Number: ##
# Suppress all events (when context is set) and increment hash-table
repeat-count.
# This rule is passed over until follow-on rule sets context.
# myKey = host+monitor
#========================================
type=Single
continue=DontCont
ptype=RegExp
pattern=(\S+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(.*)\s+::\s+(\S+.*)
context=dup_detect::$2::$4
desc=dup_detect_suppress::$2::$4
action=lcall %repeat_count $2 $4 -> ( sub { my $myKey = "$_[0]"."::"."$_[1]";
return (++$repeat_count{$myKey}); } ) \
; write %SEC_HOME/log/sec.main.log %u %s (%repeat_count)
#========================================
# Rule_Number: ##
# Retrieve hash-value (the seconds) for the host+monitor pair,
# and set context for that time. Also initialize repeat_count to 0.
# myKey = host+monitor; context is used in above rule.
#========================================
type=Single
continue=TakeNext
ptype=RegExp
pattern=(\S+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(.*)\s+::\s+(\S+.*)
context=($2 $4) -> ( sub { my $myKey = "$_[0]"."::"."$_[1]"; if ( defined
$dup_detect{$myKey} ) { return 1; } } )
desc=dup_detect::$2::$4
action=lcall %dup_timer $2 $4 -> ( sub { my $myKey = "$_[0]"."::"."$_[1]"; \
$repeat_count{$myKey} = 0; return ($dup_detect{$myKey}); } ) \
;create %s %dup_timer; write %SEC_HOME/log/sec.main.log %u %s::%dup_timer
Regards,
Gary
-----Original Message-----
From: Risto Vaarandi [mailto:risto.vaara...@seb.ee]
Sent: Wednesday, March 13, 2013 9:05 AM
To: Boyles, Gary P
Cc: simple-evcorr-users@lists.sourceforge.net
Subject: Re: [Simple-evcorr-users] PairWithWindow Help Needed.
On 03/13/2013 05:25 PM, Boyles, Gary P wrote:
> Risto,
> Yes, I'm specifying integers through a web interface. At this point though,
> it is through
> a list of integers rather than free-form integers.
>
> I'm trying to minimize the number of rules written, by utilizing hash-tables
> to decide on whether
> a particular node or group will use a particular rule (via context).
>
> The problem with just writing out rules is that you might have a rule for a
> window of 1 second,
> one for 2 seconds, one for 30 seconds, etc. And since there are a lot of
> users that might use
> this interface, I'd rather have one rule that looks at values in a hash for
> context to determine
> whether to use a particular rule or not.
>
> I have implemented a form of suppression (aka duplicate-detection) with what
> you describe below
> (i.e. two "Single" rules with context set via hash-variable).
>
> This way... I only need two rules to implement "SingleWithSuppress" for any
> time-window.
>
> I will look at doing the same thing and replicating PairWithWindow.
>
> Thanks for your help.
> Gary
>
I see your point now -- since essentially you would like to store part
of the rule definition in some external storage, a rule would actually
become a kind of a skeleton/template which evaluates to a different rule
definition at each event match. I have to admit I haven't thought about
such feature before, and I think it hasn't been discussed before in the
mailing list either.
kind regards,
risto
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
