In message <01aa01cf449e$ea052140$be0f63c0$@gmail.com>, "andrewarnier" writes:
>Hi john, >I want a Pair rule where action is executed when pattern matches and action2 >is run only if pattern2 is matched within window (10) seconds >Is there some other way I can get patter time (%time1) and pattern2 (@time) >when pattern matches and pattern2 is matched within window (10) sec. > You just repeated the last line of my previous email. See the man page for the Pair rule. >Is there some other way I can get %time1 and %time and pipe all to sec_fifo >? > >Andrew >-----Original Message----- >From: John P. Rouillard [mailto:rou...@cs.umb.edu] >Sent: Thursday, March 20, 2014 9:30 PM >To: andrewarnier >Cc: simple-evcorr-users@lists.sourceforge.net >Subject: Re: [Simple-evcorr-users] get patter1 parameter > > >In message <014701cf4415$140fde60$3c2f9b20$@gmail.com>, >"andrewarnier" writes: > >>I have set a rule as follow, but I can't get %time1 when write SEC_fifo > >You define time1 in "action", but not in action2. Only one of "action" or >action2 will fire in a PairWithWindow rule. If action2 fires, "action" has >not fired therefore time1 is never defined. > >Please read the manual section PAIRWITHWINDOW RULE. > >Stripped rule follows: > >>type=PairWithWindow >> >>pattern=(\S+) ONS-15454 Carrier Loss On The LAN in (\S+) >>\(majorServiceAffecting\),ifIndex=(.+) > >This is only called if pattern2 IS NOT matched within 10 seconds. > >>action=lcall %time1 -> ( sub { my(@time1) = localtime(); \ >> my($timestamp) = sprintf( "%04d-%02d-%02d %02d:%02d:%02d", \ >> $time1[5]+1900, $time1[4]+1, $time1[3], $time1[2], $time1[1], >>$time1[0]); \ >> return $timestamp; } ) > > >>pattern2=(\S+) NONS-15454 Transport Layer Failure in (\S+) >>\(majorServiceAffecting\),ifIndex=(.+) > >Action2 is only called if pattern2 is matched within 10 seconds. > >>action2=lcall %time -> ( sub { my(@time) = localtime(); \ >> my($timestamp) = sprintf( "%04d-%02d-%02d %02d:%02d:%02d", \ >> $time[5]+1900, $time[4]+1, $time[3], $time[2], $time[1], $time[0]); \ >> return $timestamp; } );\ >> write SEC_fifo %time1,%time,ONS-15454,NONS-15454...; \ >> shellcmd /home/andrew/code/sendmail.sh "ONS-15454 ...Carrier Loss On The >LAN %2 ifIndex=%3" "%s" "%time" > >>window=10 > >I assume %time is printed just fine since it is defined in action2 before it >is used. > >Do you want a Pair rule where action is executed when pattern matches and >action2 is run only if pattern2 is matched within window (10) seconds? > >-- > -- rouilj >John Rouillard >=========================================================================== >My employers don't acknowledge my existence much less my opinions. ------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. Written by three acclaimed leaders in the field, this first edition is now available. Download your free book today! http://p.sf.net/sfu/13534_NeoTech _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
