[Simple-evcorr-users] Suggestions for handling multiple streams/events - disabling alerting based on source, etc.

I am just getting started here, but I know we will be able to get what we want, I just need a little push in the right direction for implementing this. So far I have this simple conf:# Set variables on SEC startup or soft restarts. These variables can be used # in actions and contexts. They are no

Re: [Simple-evcorr-users] Suggestions for handling multiple streams/events - disabling alerting based on source, etc.

$_[2] =~ m/.*\/(.*)\.SystemOut\.log$/); } else { return 0; } }desc=$0action="" Error reported by Application: %app on Layer: %layer: $1 caught in: $2or I try return ($1, $_[1] =~ m/.*\/(.*)\.SystemOut\.log$/); } else { return 0; } } But then I get bad output!-Risto Vaarandi wrote: -To: John

Re: [Simple-evcorr-users] Suggestions for handling multiple streams/events - disabling alerting based on source, etc.

orking fine, short lived context blocking of further alerts works just great...my email script is being triggered perfectly, its just his now ;)Thanks for your help! -Risto Vaarandi wrote: -To: John Grasett From: Risto Vaarandi Date: 04/17/2011 10:38AMCc: simple-evcorr-users Subject: Re:

Re: [Simple-evcorr-users] Suggestions for handling multiple streams/events - disabling alerting based on source, etc.

I figured this one out on my own, should have got it long ago really...its a simple as putting:eval %server "$2" =~ m/.*\/(.*)\.SystemOut\.log$/; into my action line.Thanks again for your help and great SEC!-John Grasett/Europe/Ascendant wrote: -To: risto.vaara...@gmail.com

[Simple-evcorr-users] Manipulating variables in perlfunc sub

I am sorry, for some reason I was not getting replies to my other thread and missed your valuable help! I have implemented that, and it works very well. I had also found when using the eval, that $2 of course would not have the value I expected until the action was carried out , and so it made my

Re: [Simple-evcorr-users] Filtering duplicate events

How are you invoking SEC? what's the command line yo use to start it?Cheers!John G.Date: Tue, 26 Jul 2011 15:51:01 +0200From: Elia Mariani Subject: [Simple-evcorr-users] Filtering duplicate eventsTo: simple-evcorr-users@lists.sourceforge.netMessage-ID: Content-Type: text/plain; charset="iso-8859-1

[Simple-evcorr-users] Rules to increment/decrement a counter, add, remove items from a list, and fire on counter threshold.

Rules to increment/decrement a counter, add, remove items from a list, and fire on counter threshold.Given a number of servers, and rules in existance already:1. detect OOM, add a context: OOM_on_serverX (!OOM_on_severX is ther also to prevent repeat rule matches)2. detect a server restart, delete

Re: [Simple-evcorr-users] Is it possible to setup a variIs it possible to setup a variable threshold?

Yes, you can do this, I have done it to count servers going OOM, with a rule to increment, decrement and one to check the total against a threshold. It is part of a larger framework, so you see for exmapolke a server start doing all sorts of things to events.#rule to catch OOM and increment counte