Thanks! Your example works fine, but I think I'm missing something obvious
when trying to load POSIX at startup. I took this from the FAQ
type=single
desc=Set log file and addressee list
ptype=substr
pattern=SEC_STARTUP
context=SEC_INTERNAL_EVENT
action=assign %a 0; eval %a (use POSIX qw(strftime);); eval %a (exit(1)
unless %a)
[logh...@netlog1 sec]# ./bin/sec.pl -conf rules/other.sec -input=- -debug=6
SEC (Simple Event Correlator) 2.5.3
Reading configuration from rules/other.sec
1 rule loaded from rules/other.sec
Stdin connected to terminal, SIGINT can't be used for changing the logging
level
foo
Evaluating code 'return strftime("/tmp/%Y-%m-%d.log",localtime());' and
setting variable '%w'
Error evaluating code 'return strftime("/tmp/%Y-%m-%d.log",localtime());':
Undefined subroutine &main::SEC::strftime called at (eval 7) line 1.
Writing event 'foo' to file %w'
B*
--
Brian C Landers
http://www.packetslave.com/
CCIE #23115
------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
