Correction -- this also produces the same error But this does not: # ----- Radius Auth Failure ----- # type=SingleWithSuppress ptype=regexp pattern=T(\d\d:\d\d:\d\d).*? (.*?) poll-radius.*?Radius auth request against (.*?) failed desc=$3 Radius auth request failed action=write /home/tocops/.tocpipe ops $1 Radius on $3 failed; action=shellcmd /opt/local/script/send-sms -m %s -s sec -r stuartk window=60
--sk -----Original Message----- From: Stuart Kendrick Sent: Tuesday, March 16, 2021 3:14 PM To: simple-evcorr-users@lists.sourceforge.net Subject: executing multiple actions I am struggling to execute multiple actions. I don't see mention of how to execute multiple actions in the sec man page http://simple-evcorr.github.io/man.html ... but from this page: http://simple-evcorr.sourceforge.net/SEC-tutorial/article.html I believed that separating actions with semi-colons would be sufficient But perhaps not This works: # ----- Radius Auth Failure ----- # type=SingleWithSuppress ptype=regexp pattern=T(\d\d:\d\d:\d\d).*? (.*?) poll-radius.*?Radius auth request against (.*?) failed desc=$3 Radius auth request failed action=shellcmd /opt/local/script/send-sms -m %s -s sec -r stuartk window=60 As does this: # ----- Radius Auth Failure ----- # type=SingleWithSuppress ptype=regexp pattern=T(\d\d:\d\d:\d\d).*? (.*?) poll-radius.*?Radius auth request against (.*?) failed desc=$3 Radius auth request failed action=write /home/tocops/.tocpipe ops $1 Radius on $3 failedwindow=5 window=60 But this does not: # ----- Radius Auth Failure ----- # type=SingleWithSuppress ptype=regexp pattern=T(\d\d:\d\d:\d\d).*? (.*?) poll-radius.*?Radius auth request against (.*?) failed desc=$3 Radius auth request failed action=write /home/tocops/.tocpipe ops $1 Radius on $3 failedwindow=5; action=shellcmd /opt/local/script/send-sms -m %s -s sec -r stuartk window=60 2021-03-16T15:09:56.146094-07:00 vishnu sec[7941]: Reading configuration from /opt/local/etc/sec/service.conf 2021-03-16T15:09:56.146198-07:00 vishnu sec[7941]: Rule in /opt/local/etc/sec/service.conf at line 8: Invalid action 'action=shellcmd /opt/local/script/send-sms -m %s -s sec -r stuartk' 2021-03-16T15:09:56.146289-07:00 vishnu sec[7941]: Rule in /opt/local/etc/sec/service.conf at line 8: Invalid action list ' write /home/tocops/.tocpipe ops $1 Radius on $3 failedwindow=5; action=shellcmd /opt/local/script/send-sms -m %s -s sec -r stuartk ' 2021-03-16T15:09:56.146363-07:00 vishnu sec[7941]: No valid rules found in configuration file /opt/local/etc/sec/service.conf Is executing multiple actions supported? If so, do I need more than a semi-colon in terms of syntax? --sk Stuart Kendrick Allen Institute _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
