Yes, you are right.
># put two matching events in within 10 seconds
>"deploymentId" => foodeployment#(sd2)",
>"deploymentId" => foodeployment#(sd2)",
I hope the second event will trigger the end action, too. How can I do that?
I am using the following rule now:
type=EventGroup
ptype=RegExp
thresh=2
window=10
pattern=\"deploymentId\"\s+=>\s+(\S+)deployment#(\S+)\",
desc=CHECK_INTERVAL_$2
action=assign %deploymentId $2;\
create deploymentId_$2;\
create DEPLOYMENTID_CONTEXT;\
write - $2 heart beats heard within 10s.
slide=reset 0 %s;
end=write - $2 not heard for 10s since last receive event.
I am not sure if the slide action will do what I expected it to do.
Thanks.
Yuheng
On Wed, Jul 23, 2014 at 11:01 PM, John P. Rouillard <rou...@cs.umb.edu>
wrote:
>
> Hello:
>
> In message
> <cadjfwj0pvlesvf1eocv+s316coj3kllepuhy_oqqnndvjjx...@mail.gmail.com> ,
> Yuheng Du writes:
>
> >I was using the event group method to check the interval between events.
> So
> >I use:
> >
> >type=EventGroup
> >ptype=RegExp
> >thresh=2
> >window=10
> >pattern=\"deploymentId\"\s+=>\s+(\S+)deployment#(\S+)\",
> >desc=CHECK_INTERVAL_$2
> >action=assign %deploymentId $2;\
> > create deploymentId_$2;\
> > create DEPLOYMENTID_CONTEXT;\
> > reset 0 %s;\
> >write - $2 heart beats heard within 10s.
> >end=write - $2 not heard for 10s since last receive event.
> >
> >When I sent two events within 10s:
> >
> >"deploymentId" => dsrgdeployment#srb_2",
> >"deploymentId" => dsrgdeployment#srb_2",
> >
> >It gives me : "srb_2 heart beats heard within 10s".
>
> Exactly as it should. The action triggered and wrote out the message.
>
> >But the second event did not trigger an end action like "srb_2 not heard
> >for 10s since last receive event", which I hope it should do.
>
> Only the first event with no second event within 10 seconds should
> trigger the end action. Did you wait long enough?
>
> It works for me with test.sec containg the rule above.
>
> ~/tmp> /tools/sec/bin/sec -conf test.sec -input -
> SEC (Simple Event Correlator) 2.7.2
> Reading configuration from test.sec
> 1 rules loaded from test.sec
> Opening input file -
> Stdin connected to terminal, SIGINT can't be used for changing the logging
> level
>
> # put two matching events in within 10 seconds
>
> "deploymentId" => foodeployment#(sd2)",
> "deploymentId" => foodeployment#(sd2)",
>
>
> Assigning '(sd2)' to variable '%deploymentId'
> Creating context 'deploymentId_(sd2)'
> Creating context 'DEPLOYMENTID_CONTEXT'
> Terminating event correlation operation 'test.sec | 0 |
> CHECK_INTERVAL_(sd2)'
> Writing event '(sd2) heart beats heard within 10s.' to file -
> (sd2) heart beats heard within 10s.
>
> # ^^^ this is all your action rule triggered as expected.
>
> # wait 30 seconds just to make sure the end is NOT triggered.
> # the end was NOT triggered as we want
>
> # put in just one event
>
> "deploymentId" => foodeployment#(sd2)",
> Writing event '(sd2) not heard for 10s since last receive event.' to file -
> (sd2) not heard for 10s since last receive event.
> # ^^ as we wanted if there is no second rule, report the end condition
>
> --
> -- rouilj
> John Rouillard
> ===========================================================================
> My employers don't acknowledge my existence much less my opinions.
>
------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
