[Simple-evcorr-users] [SEC] crashes with SingleWithThreshold rule

2010-01-18 Thread antonin mora
Sometimes, sec.pl crashes but i don't know why. And if i restart sec.pl and replay this alert, everything works fine. I suppose that the problem is in function "process_singlewiththreshold_rule" so i transformed it to have a lot of logs. (I use sec.pl version 2.5.3 and the library dumper to displ

Re: [Simple-evcorr-users] [SEC] crashes with SingleWithThreshold rule

2010-01-18 Thread Risto Vaarandi
hi, I had a quick look at the code, and the code fragment looks like follows: if (!exists($corr_list{$key})) { if (scalar(@{$subst})) { $action = []; $action2 = []; copy_actionlist($ref->{"Action"}, $action); copy_actionlist($ref->{"Action2"}, $action2); s

Re: [Simple-evcorr-users] [SEC] crashes with SingleWithThreshold rule

2010-01-18 Thread John P. Rouillard
In message <4b5479fa.2040...@seb.ee>, Risto Vaarandi writes: >Can you tell more about the platform you are running SEC on? Are you >sure your Perl version is OK? Is your hardware OK? > >Last but not least -- from your previous posts I have got an >understanding that you have modified SEC code fo

Re: [Simple-evcorr-users] [SEC] crashes with SingleWithThreshold rule

2010-01-25 Thread antonin mora
Hi, After some research, crashes happened in OUR system when we reload many times. Our system includes a web interface which generates new rules, puts a tar file with this rules on a server and calls a perl script. This perl script deletes old rules, untars new rules and executes a "kill -6" on