On 02/17/2014 10:30 AM, andrewarnier wrote: > Hi all, > > I have set a PairWithWindow rule as follows, > > type=PairWithWindow > > ptype=RegExp > > pattern=(.+)-(.+) Transport Layer Failure in FAC-(.+)-(.+) > \(majorServiceAffecting\),ifIndex=(.+) > > desc= $1-$2 Transport Layer Failure in FAC-$3-$4 > \(majorServiceAffecting\),ifIndex=$5 > > action=write - $1-$2 Transport Layer Failure in FAC-$3-$4 > \(majorServiceAffecting\),ifIndex=$5 > > ptype2=RegExp > > pattern2=(.+)-(.+) Loss Of Signal in FAC-(.+)-(.+)-(.+) > \(criticalServiceAffecting\),ifIndex=(.+) > > desc2=$1-$2 Loss Of Signal in FAC > > action2 = ???? #how to write pattern desc and pattern2 desc ????
Official docs for PairWithWindow rule contain an example which describes in a detailed way how this rule type works, and how to use match variables across two patterns. In the most recent documentation version, this example is equipped with sample log messages and step-by-step explanation how things work: http://simple-evcorr.sourceforge.net/man.html#lbAP I'd recommend to look into this example. risto > > window=5 > > for example : > > #perl /usr/local/sbin/sec.pl -conf=snmptt_test_sec.cfg -input=- > > EN-15454 Transport Layer Failure in > FAC-5-1(majorServiceAffecting),ifIndex=4098 > > NY-15454 Transport Layer Failure in FAC-21-1 > (majorServiceAffecting),ifIndex=4098 > > I can get the string as follow: > > EN-15454 Transport Layer Failure in > FAC-5-1(majorServiceAffecting),ifIndex=4098 and NY-15454 Transport Layer > Failure in FAC-21-1 (majorServiceAffecting),ifIndex=4098 > > Can anyone give me some advice on what to do please? > > Andrew > > > > ------------------------------------------------------------------------------ > Android apps run on BlackBerry 10 > Introducing the new BlackBerry 10.2.1 Runtime for Android apps. > Now with support for Jelly Bean, Bluetooth, Mapview and more. > Get your Android app in front of a whole new audience. Start now. > http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk > > > > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ Android apps run on BlackBerry 10 Introducing the new BlackBerry 10.2.1 Runtime for Android apps. Now with support for Jelly Bean, Bluetooth, Mapview and more. Get your Android app in front of a whole new audience. Start now. http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
