Jon Salud wrote:
> Hello there,
>
> The following rule doesn't seem to be read according to /tmp/sec.dump
>
> type = Single
> desc = context $1 $2
> ptype = PerlFunc
> pattern = sub { if ($_[0] =~ /^(\S+) \S+ (\S+)/) { return ($1, $2,
> $_[1]); } return 0; }
> context = !good_ip_$1 && (bad_ip_$1 || bad_string_$2)
> action = shellcmd ./notify.ksh "%t|$3|$2|$1|$0"
>
> I populate all the good_ip_xxx, bad_ip_xxx, bad_string_xxx contexts at
> the beginning, but this rule doesn't seem to work when I try and test
> it. When I remove the parentheses from the 'context' line it somewhat
> works, but doesn't behave the way I intend it to. Any thoughts?
>
hi Jon,
I tested the rule on my Linux workstation by feeding various string
tuples (A, B, C) to SEC, having separate rules put to place for creating
and deleting contexts for the first and third elements of tuples (A and
C, that is). I couldn't find any problem with the rule - if either
bad_ip_A or bad_string_C (or both) exist, and good_ip_A does not exist,
the rule fires; otherwise the action is not executed.
Therefore, I am strongly suspecting that the 'pattern' parameter does
not correctly capture your input. As John suggested, it would be most
helpful if you could provide us some samples of your actual input.
best regards,
risto
> ~Jon~
>
>
> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
