In message <[email protected]>, 686f6c6d writes:
>On Tue, Jul 7, 2009 at 18:10, John P. Rouillard<[email protected]> wrote: >> [...] One other solution is to set up a >> context based framework that allows rules to indicate that a >> particular event was handled, and the other rulesets should ignore it. >> >> Such a framework is used/described at >> http://www.cs.umb.edu/~rouilj/sec/. Rather than [...] > >Thanks so much for that example setup. Took me a while to grasp it, >but now it works like a charm with only minimal changes (adding the >two EVENT_PROCESSED rules to the 10/20 configs and copying your 99 >config). Cool. Glad it works for you. >> Equivalently, given your ruleset structure: [...] >> you can set up sec-10-suppress to act like a traffic cop and use it to >> identify what ruleset a given event should go to. Then the sec-20 >> sec-30.... rulesets would not be run by default (see OPTIONS RULE >> procallin setting) on every event. They would only be run if the >> sec-10-suppress (maybe better named sec-10-sort) ruleset selected an >> event to be processed by one or more rulesets. > >Please correct me if I'm wrong, but wouldn't that inevitably lead to a >huge sec-10-sort config file? Or am I overlooking something? Perhaps. You could set up sec-10-sort, sec-11-sort, sec-12-sort etc. Usually categorization rules don't overlap so having the same event processed by multiple rulesets is just a performance issue since a given event will trigger on only one rule. You could also use the framework mentioned above to allow you to have multiple categorization files where the first rule match inhibits processing of non-guard rules in the other files. Using jump should be more efficient than the guard rule framework as you eliminate the guard rule execution (1-3 rules/file) which can add up if you have lots of files. -- -- rouilj John Rouillard =========================================================================== My employers don't acknowledge my existence much less my opinions. ------------------------------------------------------------------------------ Enter the BlackBerry Developer Challenge This is your chance to win up to $100,000 in prizes! For a limited time, vendors submitting new applications to BlackBerry App World(TM) will have the opportunity to enter the BlackBerry Developer Challenge. See full prize details at: http://p.sf.net/sfu/Challenge _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
