Re: [Simple-evcorr-users] Maintaining events while modifying rules

[David Lang]

what I would do is to have some other process filter the logs to send to 
multiple sec instances, then you can have the one copy that is critical only 
dealing with the logs it must see (better for performance anyway) and then you 
can have other copies that have more general rules and you can restart more 
readily.

David Lang

_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users