hi Stuart, if you want to specify multiple actions for the 'action' field of the rule, semicolon should indeed be used as a separator. However, the 'action' keyword with an equal sign should appear just once in the beginning of the rule field definition. Therefore, the example rule from your post would need one small modification:
type=SingleWithSuppress ptype=regexp pattern=T(\d\d:\d\d:\d\d).*? (.*?) poll-radius.*?Radius auth request against (.*?) failed desc=$3 Radius auth request failed action=write /home/tocops/.tocpipe ops $1 Radius on $3 failedwindow=5; shellcmd /opt/local/script/send-sms -m %s -s sec -r stuartk window=60 hope this helps, risto Kontakt Stuart Kendrick (<stua...@alleninstitute.org>) kirjutas kuupäeval K, 17. märts 2021 kell 00:48: > > I am struggling to execute multiple actions. I don't see mention of how to > execute multiple actions in the sec man page > http://simple-evcorr.github.io/man.html ... but from this page: > http://simple-evcorr.sourceforge.net/SEC-tutorial/article.html > I believed that separating actions with semi-colons would be sufficient > > > But perhaps not > > > This works: > # ----- Radius Auth Failure ----- > # > type=SingleWithSuppress > ptype=regexp > pattern=T(\d\d:\d\d:\d\d).*? (.*?) poll-radius.*?Radius auth request against > (.*?) failed > desc=$3 Radius auth request failed > action=shellcmd /opt/local/script/send-sms -m %s -s sec -r stuartk > window=60 > > As does this: > # ----- Radius Auth Failure ----- > # > type=SingleWithSuppress > ptype=regexp > pattern=T(\d\d:\d\d:\d\d).*? (.*?) poll-radius.*?Radius auth request against > (.*?) failed > desc=$3 Radius auth request failed > action=write /home/tocops/.tocpipe ops $1 Radius on $3 failedwindow=5 > window=60 > > But this does not: > # ----- Radius Auth Failure ----- > # > type=SingleWithSuppress > ptype=regexp > pattern=T(\d\d:\d\d:\d\d).*? (.*?) poll-radius.*?Radius auth request against > (.*?) failed > desc=$3 Radius auth request failed > action=write /home/tocops/.tocpipe ops $1 Radius on $3 failedwindow=5; > action=shellcmd /opt/local/script/send-sms -m %s -s sec -r stuartk > window=60 > > > 2021-03-16T15:09:56.146094-07:00 vishnu sec[7941]: Reading configuration from > /opt/local/etc/sec/service.conf > 2021-03-16T15:09:56.146198-07:00 vishnu sec[7941]: Rule in > /opt/local/etc/sec/service.conf at line 8: Invalid action 'action=shellcmd > /opt/local/script/send-sms -m %s -s sec -r stuartk' > 2021-03-16T15:09:56.146289-07:00 vishnu sec[7941]: Rule in > /opt/local/etc/sec/service.conf at line 8: Invalid action list ' write > /home/tocops/.tocpipe ops $1 Radius on $3 failedwindow=5; action=shellcmd > /opt/local/script/send-sms -m %s -s sec -r stuartk ' > 2021-03-16T15:09:56.146363-07:00 vishnu sec[7941]: No valid rules found in > configuration file /opt/local/etc/sec/service.conf > > Is executing multiple actions supported? If so, do I need more than a > semi-colon in terms of syntax? > > --sk > > Stuart Kendrick > Allen Institute > > > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
