Hello,
I have to monitor two log files, each one have to match its own SEC
rules. I'm trying to set up a "Pair" based rule : a regexp triggers an
action and a substr reset the events lists. It's OK as far as I give a
single file on the command line ; only one --input parameter.
If I build a context, as described in the man, with --intcontexts and
--input=my_log=MY_CONTEXT switches, and the context=MY_CONTEXT in the
config file, along with others --input files, the first event is
detected on the input file linked by its context : very good.
But the pattern2 is triggered by ANY input file. SEC ignores the
context. The pattern2 should be matched against the inputfile linked by
the context, isn't it ?
My config only describes the ruleset for the first file (if OK the
reuleset for the second file should be similar) :
---- sec.rules -----------------------
type=Pair
context=[CFT]
ptype=regexp
pattern=(?i)(ERROR|WARNING)
desc=Alamm $1 on $+{_inputsrc}
action=logonly
ptype2=substr
pattern2=receiving file list ... done
desc2=Alarm end on $+{_inputsrc}
action2=logonly
window=60
---- sec.rules -----------------------
Command line :
./sec --intcontexts --conf=config/sec.rules \
--input=log/RECEPTION.log=CFT \
--input=log/OUTPUT.log=OTHER
Perl v5.8.8 built for aix-thread-multi
Interesting fact : $+{_inputsrc} displays "log/RECEPTION.log" even if
pattern2 is matched against "log/OUTPUT.log".
Could you please help me, should context act like I hope it does, am I
wrong in my set up, ... ?
Thank you very much !
------------------------------------------------------------------------------
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
