Hi, I just changed an existing setup to make use of SECRC instead of having to change SEC startup for each change in the list of monitored files. There seems to be a problem with how SEC processes the configuration lines in the SECRC file, though.
My SEC setup, as logged in the dump file, looks like this: Program information: ============================================================ Program version: SEC (Simple Event Correlator) 2.4.2 Time of the start: Mon Feb 2 11:57:20 2009 Time of the last configuration load: Mon Feb 2 11:57:20 2009 Time of the dump: Mon Feb 2 11:59:11 2009 Program resource file: /opt/sec/etc/sec.files Program options: -conf /opt/sec/etc/rules/*.conf -log /opt/sec/var/log/sec.log -pid /opt/sec/var/run/sec.pid -detach -debug 7 -intevents -intcontexts -input /opt/sec/var/log/patrolevents=PATROLEVENTS -input /opt/sec/var/log/messages=MESSAGES There is, however, no input source in the dump, and consequently there are also no files that SEC reads input from: Input sources: ============================================================ If I write the exact lines from the SECRC file to the startup command, everything is fine: Program information: ============================================================ Program version: SEC (Simple Event Correlator) 2.4.2 Time of the start: Mon Feb 2 12:50:04 2009 Time of the last configuration load: Mon Feb 2 12:50:04 2009 Time of the dump: Mon Feb 2 12:50:27 2009 Program resource file: /opt/sec/etc/sec.files Program options: -conf /opt/sec/etc/rules/*.conf -log /opt/sec/var/log/sec.log -pid /opt/sec/var/run/sec.pid -detach -debug 7 -intevents -intcontexts -input /opt/sec/var/log/patrolevents=PATROLEVENTS -input /opt/sec/var/log/messages=MESSAGES Input sources: ============================================================ /opt/sec/var/log/patrolevents (status: Open, received data: 0 lines, context: PATROLEVENT) /opt/sec/var/log/messages (status: Open, received data: 0 lines, context: MESSAGES) Obviously, SEC reads the resource file and parses the options correctly, but the files are not opened and monitored. Any ideas what I could test for or what I am doing wrong? Best regards, Peter. ------------------------------------------------------------------------------ This SF.net email is sponsored by: SourcForge Community SourceForge wants to tell your story. http://p.sf.net/sfu/sf-spreadtheword _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
