How do you define a change in the trap? br, risto
--- On Mon, 5/31/10, Javier <[email protected]> wrote: From: Javier <[email protected]> Subject: [Simple-evcorr-users] Can SEC help me ?? To: "simple-evcorr-users" <[email protected]> Date: Monday, May 31, 2010, 8:15 PM Hi, i need to make a persistance correlation and i´m not sure if SEC can help me. It should goes like this: I receive traps with a determinate OID in a log file as raw data, then i write the output to a DB to show it later as an alarm. I want to show the first coincidence and i want to correlate the event to show only when its a change in the trap during a time threshold and if there´s a change in that same event, reset that time threshold and of course show the changes. I prefer do it in memory and not in DB... Well, is it possible to do that with SEC? and if yes... HOW??? maybe using several rules in the same conf file?? thanks in advance -----Inline Attachment Follows----- ------------------------------------------------------------------------------ -----Inline Attachment Follows----- _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users ------------------------------------------------------------------------------ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
