2014-07-24 6:06 GMT+03:00 Yuheng Du <yuhe...@clemson.edu>:
> Yes, you are right.
>
> ># put two matching events in within 10 seconds
>
> >"deploymentId" => foodeployment#(sd2)",
> >"deploymentId" => foodeployment#(sd2)",
>
> I hope the second event will trigger the end action, too. How can I do
> that?
>
> I am using the following rule now:
>
> type=EventGroup
> ptype=RegExp
> thresh=2
> window=10
> pattern=\"deploymentId\"\s+=>\s+(\S+)deployment#(\S+)\",
> desc=CHECK_INTERVAL_$2
> action=assign %deploymentId $2;\
> create deploymentId_$2;\
> create DEPLOYMENTID_CONTEXT;\
> write - $2 heart beats heard within 10s.
> slide=reset 0 %s;
> end=write - $2 not heard for 10s since last receive event.
>
> I am not sure if the slide action will do what I expected it to do.
>
> Thanks.
>
> Yuheng
>
>
> On Wed, Jul 23, 2014 at 11:01 PM, John P. Rouillard <rou...@cs.umb.edu>
> wrote:
>
>>
>> Hello:
>>
>> In message
>> <cadjfwj0pvlesvf1eocv+s316coj3kllepuhy_oqqnndvjjx...@mail.gmail.com> ,
>>
>> Yuheng Du writes:
>>
>> >I was using the event group method to check the interval between events.
>> So
>> >I use:
>> >
>> >type=EventGroup
>> >ptype=RegExp
>> >thresh=2
>> >window=10
>> >pattern=\"deploymentId\"\s+=>\s+(\S+)deployment#(\S+)\",
>> >desc=CHECK_INTERVAL_$2
>> >action=assign %deploymentId $2;\
>> > create deploymentId_$2;\
>> > create DEPLOYMENTID_CONTEXT;\
>> > reset 0 %s;\
>> >write - $2 heart beats heard within 10s.
>> >end=write - $2 not heard for 10s since last receive event.
>> >
>> >When I sent two events within 10s:
>> >
>> >"deploymentId" => dsrgdeployment#srb_2",
>> >"deploymentId" => dsrgdeployment#srb_2",
>> >
>> >It gives me : "srb_2 heart beats heard within 10s".
>>
>> Exactly as it should. The action triggered and wrote out the message.
>>
>>
>> >But the second event did not trigger an end action like "srb_2 not heard
>> >for 10s since last receive event", which I hope it should do.
>>
>> Only the first event with no second event within 10 seconds should
>> trigger the end action. Did you wait long enough?
>>
>> It works for me with test.sec containg the rule above.
>>
>> ~/tmp> /tools/sec/bin/sec -conf test.sec -input -
>> SEC (Simple Event Correlator) 2.7.2
>> Reading configuration from test.sec
>> 1 rules loaded from test.sec
>> Opening input file -
>> Stdin connected to terminal, SIGINT can't be used for changing the
>> logging level
>>
>> # put two matching events in within 10 seconds
>>
>> "deploymentId" => foodeployment#(sd2)",
>> "deploymentId" => foodeployment#(sd2)",
>>
>>
>> Assigning '(sd2)' to variable '%deploymentId'
>> Creating context 'deploymentId_(sd2)'
>> Creating context 'DEPLOYMENTID_CONTEXT'
>> Terminating event correlation operation 'test.sec | 0 |
>> CHECK_INTERVAL_(sd2)'
>> Writing event '(sd2) heart beats heard within 10s.' to file -
>> (sd2) heart beats heard within 10s.
>>
>> # ^^^ this is all your action rule triggered as expected.
>>
>> # wait 30 seconds just to make sure the end is NOT triggered.
>> # the end was NOT triggered as we want
>>
>> # put in just one event
>>
>> "deploymentId" => foodeployment#(sd2)",
>> Writing event '(sd2) not heard for 10s since last receive event.' to file
>> -
>> (sd2) not heard for 10s since last receive event.
>> # ^^ as we wanted if there is no second rule, report the end condition
>>
>> --
>> -- rouilj
>> John Rouillard
>>
>> ===========================================================================
>> My employers don't acknowledge my existence much less my opinions.
>>
>
>
>
> ------------------------------------------------------------------------------
> Want fast and easy access to all the code in your enterprise? Index and
> search up to 200,000 lines of code with a free copy of Black Duck
> Code Sight - the same software that powers the world's largest code
> search on Ohloh, the Black Duck Open Hub! Try it now.
> http://p.sf.net/sfu/bds
> _______________________________________________
> Simple-evcorr-users mailing list
> Simple-evcorr-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
>
------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
