In message <[EMAIL PROTECTED]>,
"Hari Sekhon" writes:
>I want to suppress a recurring 4 line event which is of no importance
>to me but is tripping my other rules.
>
>Ok, so just use suppression like I do elsewhere I thought, however....
>I don't want to suppress the lines individually, I only want to
>suppress them when all 4 lines occur within 2 seconds of each other
>and I want either all 4 suppressed or none of the 4 suppressed.
>
>So I tried a multiline regex suppression but this only suppressed the
>4th line, the other 3 still turn up in in the next rules.
>
>Then I thought I'd try building contexts for each line so successive
>rules could reference them, but in testing this suffered from the same
>problems as above.
>
>The issue I think is that input lines are passed along to other rules
>for evaluation and are acted upon before the 4 line to complete any
>correlation can be seen.
>
>If I recall correctly, this is normal behaviour to pass lines on for
>immediate evaluation by other rules but it leaves me wondering how to
>suppress these 4 line events... but not to suppress each individual
>line which may have some significance if found without the other
>lines...
>
>Any ideas?
Yup this is just off the top of my head:
1 rule that matches all 4lines
context = matching_4lines && ! failed_4way
action = delete matching_4lines
2 first line matching rule
context = ! failed_4way
action = create context matching_4lines for 2 seconds
when it expires:
create context failed_4way match
copy matching_4lines %m
event %m
event "END REPLAY"
add matching_4lines $0
3 single rule that matches any line, or two single rules that match
lines 2 and 3
context = matching_4lines
action = add matching_4lines $0
4 single rule matching "END REPLAY"
action = delete failed_4way
What this does is recognize the start of the sequence, buffer the
lines in the sequence for 2 seconds. If all 4 lines didn't arrive in 2
seconds, replay the events bypassing the attempt to recognize all 4
lines.
So line 1 comes in:
rule context action
1 none ignored by context
2 none executed - context matching_4lines created
3,4 - event was consumed by rule 2, so never seen
Line 2 comes in:
rule context action
1 matching_4lines does not match regular expression
2 matching_4lines does not match regular expression
3 matching_4lines event consumed, added to context.
4 - no event
Line 2 comes in:
rule context action
1 matching_4lines does not match regular expression
2 matching_4lines does not match regular expression
3 matching_4lines event consumed, added to context.
4 - no event
line 3 proceeds along line 2. line 4:
rule context action
1 matching_4lines matches regular expression, executes
2,3,4 - no event
Now if line 3 comes in 4 seconds later we see after 2 seconds (not
driven by event):
context matching_4lines deleted
context failed_4way created
lines 1 and 2 are in the event queue and are replayed before line 3
event END REPLAY is in event queue and replayed before line 3
so line 1 replay comes in again:
rule context action
1 failed_4way ignored by context
2 failed_4way ignored by context
3 failed_4way ignored by context
4 failed_4way doesn't match regexp
5... failed_4way maybe matched and acted on
line 2 replay proceeds the same
event "END REPLAY" comes in:
rule context action
1 failed_4way ignored by context
2 failed_4way ignored by context
3 failed_4way ignored by context
4 failed_4way deletes failed_4way and consumes event
now the 4 second delayed line 3 comes in
rule context action
1 none ignored by context
2 none ignored by context
3 none ignored by context
4 none doesn't match regexp
5... none maybe matched and acted on
line 4 operates the same and is passed through for action.
Not the best looking, but I have used something similar and it worked.
You could also use a pair rule to replace rules 1 and 2 I think. The
basic layout is:
type = pair
context = ! failed_4way
pattern = match line 1
action = action from rule 2
pattern2 = pattern from rule 1
action2 = action from rule 1
context2 = this is not needed
I think this can be made to work as well.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
