Brilliant..thank you so much Risto!
James
On 2020-03-04 13:13, Risto Vaarandi wrote:
hi James,
you are observing this behavior since --detach option involves
changing working directory to root directory (that's a standard part
of turning the process into a daemon). Actually, when you look into
debug messages from SEC, there is also a message about directory
change in the terminal. Since the input file and rule file names are
relative, they will be not found in /, and to fix this issue, absolute
paths have to be used with --detach option.
hope this helps,
risto
Kontakt James Lay (<j...@slave-tothe-box.net>) kirjutas kuupäeval K,
4. märts 2020 kell 21:58:
Hey all,
So...I'm testing some stuff.....when I have an entry with logonly
things
work fine. I'm trying to run sec against a file and have the action
of
pipe work, but the pipe command is echoed to the screen. As I was
testing I noticed something odd....in a dir I have sec-test.conf and
tabbedfile. Command:
sec --conf=sec-test.conf --input=tabbedfile
SEC (Simple Event Correlator) 2.8.2
Reading configuration from sec-test.conf
4 rules loaded from sec-test.conf
No --bufsize command line option or --bufsize=0, setting --bufsize
to 1
Opening input file tabbedfile
Interactive process, SIGINT can't be used for changing the logging
level
however when I try --detach I get:
sec --conf=sec-test.conf --input=tabbedfile --detach
SEC (Simple Event Correlator) 2.8.2
Changing working directory to /
Reading configuration from sec-test.conf
Can't open configuration file sec-test.conf (No such file or
directory)
No --bufsize command line option or --bufsize=0, setting --bufsize
to 1
Opening input file tabbedfile
Input file tabbedfile does not exist!
No matter where in the command I put --detach tabbedfile suddenly is
not
found. Odd behaviour. Thank you.
James
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
