This is my first attempt at Event Procedures so bear with me if I am not
clear.
I have been trying to create an event procedure that extracts a string from
an event, parses out three sub-strings from it, and creates a event
containing the three sub-strings as variables {S 101}, {S 102}, and {S 103}.
I have tested the regex for all three successfully. I have no errors in the
event_disp_error_file. I get a new event 0xfff0000a created with only one
variable {S 101}.
It looks to me that the CreateEventWithVariables syntax may be incorrect
(comma delimited string).
I would be grateful for some help.
String from 0xfff00003: “2011-05-25 12:36:24 W3SVC1 NYCB-EXCHANGE04
10.26.128.89 POST /Microsoft-Server-ActiveSync
Cmd=Ping&User=nycb%5c28657&DeviceId=MotoA0000022C3DBA4&DeviceType=MOTOBLUR30
443 nycb\28657 75.225.53.49 HTTP/1.1 Moto-Blur/3.0 webmail.mynycb.com 401 1
1326 296 501 15 ”
0xfff00003 P \
" CreateEventWithVariables ( \
{ C CURRENT_MODEL }, \
{ H 0xfff0000a }, \
SetEventVariable ( \
GetEventVariableList (), \
{ U 101 }, \
GetRegexp ( \
GetEventVariable( { U 17 } ), \
{ S \".*443 (.*?)([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).* (HTTP.*?)
webmail\.mynycb\.com.*\" }, \
{ U 1 } \
) \
), \
SetEventVariable ( \
GetEventVariableList (), \
{ U 102 }, \
GetRegexp ( \
GetEventVariable( { U 17 } ), \
{ S \".*443 (.*?)([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).* (HTTP.*?)
webmail\.mynycb\.com.*\" }, \
{ U 2 } \
) \
), \
SetEventVariable ( \
GetEventVariableList (), \
{ U 103 }, \
GetRegexp ( \
GetEventVariable( { U 17 } ), \
{ S \".*443 (.*?)([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).* (HTTP.*?)
webmail\.mynycb\.com.*\" }, \
{ U 3 } \
) \
) \
--
Marty Davis
---
To unsubscribe from spectrum, send email to [email protected] with the body:
unsubscribe spectrum [email protected]
