We have recently upgraded to version 1.3 of NfSen. When doing so we had
a number of changes to the plugins to get them to work with the new
version. I was making the plugins more in line with the demoplugin
(if they could be), and noticed something that was causing a problem.
FIgured I'd mention it here since others may run into this, and Peter
will see the issue as well. :)
In the demoplugin there is the following code:
# Process the output and notify the duty team
my ($matched) = $output[-4] =~ /Summary: total flows: (\d+)/;
if ( defined $matched ) {
syslog('debug', "demoplugin run: $matched aggregated flows");
notify("Test flows: Profile $profile, Timeslot $timeslot", [EMAIL PROTECTED] );
} else {
syslog('err', "demoplugin: Unparsable output line '$output[-4]'");
notify("Test flows: Profile $profile, Timeslot $timeslot", [EMAIL PROTECTED] );
}
There are a couple of changes we made to make it more functional with
our plugins. One was moving the debug message out of the if statement
since when I run it in debug mode I want to know when it runs and has
zero flows. The other is the 'defined' command in the if statement.
I don't think 'defined' is the correct use since if 0 flows are found then
$matched is still defined (and I was getting empty flow notifications).
Lastly I don't think the notify in the "else" statement is needed (there
should be nothing to notify if no flows matched). So the changes we made
to the above code are:
# Process the output and notify the duty team
my ($matched) = $output[-4] =~ /Summary: total flows: (\d+)/;
syslog('debug', "demoplugin run: $matched aggregated flows");
if ( $matched ) {
notify("Test flows: Profile $profile, Timeslot $timeslot", [EMAIL
PROTECTED] );
} elsif (!defined $matched) {
syslog('err', "demoplugin: Unparsable output line '$output[-4]'");
}
--
James J. Barlow <[EMAIL PROTECTED]>
Head of Security Operations and Incident Response
National Center for Supercomputing Applications Voice : (217)244-6403
1205 West Clark Street, Urbana, IL 61801 Cell : (217)840-0601
http://www.ncsa.uiuc.edu/~jbarlow Fax : (217)244-1987
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
