On 04/30/2012 08:07 PM, mindman101 wrote: > Hello Risto, > > Thanks for your answer. However, I was trying the rules and I got > unexpected results. For example:
I forgot to change the action of the first rule. If the reporting is moved outside from the action-on-expiration list of the linkDown context, this context would not exist anymore when the actual reporting will be done. The following slightly modified ruleset would address the problem: type=Single ptype=RegExp pattern=linkDown (\S+) on interface (\S+) context=!linkDown desc=There is a link down on $1 on $2 action=create linkDown; event 3 ReportLinkDown type=Single ptype=RegExp pattern=^(RsvpIfStateChange).+ context=linkDown desc=$0 action=add linkDown RsvpIfStateChange; alias linkDown linkDownHasData type=Single ptype=RegExp pattern=^(RsvpIfNbrStateDown).+ context=linkDown desc=$0 action=add linkDown RsvpIfNbrStateDown; alias linkDown linkDownHasData type=Single ptype=RegExp pattern=ReportLinkDown context=linkDownHasData desc=report the linkdown context that has data action=copy linkDown %h; event %h; delete linkDown type=Single ptype=RegExp pattern=ReportLinkDown desc=report the linkdown context that has data action=delete linkDown > > linkDown 10.1.1.1 on interface Gi10/1 > Creating context 'linkDown' > RsvpIfStateChange > Adding event 'RsvpIfStateChange' to context 'linkDown' > Creating alias 'linkDownHasData' for context 'linkDown' > RsvpIfNbrStateDown > Adding event 'RsvpIfNbrStateDown' to context 'linkDown' > Creating alias 'linkDownHasData' for context 'linkDown' > Alias 'linkDownHasData' already exists > Deleting stale context 'linkDownHasData' > Creating event 'ReportLinkDown' > Stale context 'linkDown' deleted > Stale context 'linkDownHasData' deleted > > I guest the last rule cannot apply because the alias context expire as > soon as linkDown context die. I tried set option to extend the context > lifetime in the last rule but it didn't work. > > How can I extend the alias context lifetime so the event ReportLinkDown > can be match in the last rule? > > Raul. > > On 04/21/2012 02:21 AM, mindman101 wrote:> Hello list!> > I configured > three single rules: the first one trigger a context and the> next two add a > text to the context when there is a match.> > In the first rule I copied > the content of the context to a variable.> > I know I should use a miniperl > program to do what I need, but I don't> have any experience in perl. The > problem is:> > How can I evaluate the variable h to know whether is empty > or not? If it> is empty do nothing, if not empty, create an event. > Unfortunately, conditional execution is not currently supported in action > lists. Nevertheless, you could implement this logic through contexts (or > context aliases). Also, the original rules need modification anyway, since > 'add' creates a context with infinite lifetime if it does not exist. > type=Single ptype=RegExp pattern=linkDown (\S+) on interface (\S+) desc=There > is a link down on $1 on $2 action=create linkDown 3 (event ReportLinkDown) > type=Single pty pe=RegExp pattern=^(RsvpIfStateChange).+ context=linkDown desc=$0 action=add linkDown RsvpIfStateChange; alias linkDown linkDownHasData type=Single ptype=RegExp pattern=^(RsvpIfNbrStateDown).+ context=linkDown desc=$0 action=add linkDown RsvpIfNbrStateDown; alias linkDown linkDownHasData type=Single ptype=RegExp pattern=ReportLinkDown context=linkDownHasData desc=report the linkdown context that has data action=copy linkDown %h; event %h An alias linkDownHasData is an indication that at least one event has been added to linkDown context. The alias is another name for linkDown which gets dropped when linkDown itself expires, so no separate deletion is necessary. regards, risto> > I have this:> > type=Single> ptype=RegExp> pattern=linkDown (\S+) on interface (\S+)> desc=There is a link down on $1 on $2> action=create linkDown 3 (copy linkDown %h;<- is %h empty ->; event %s %h)> > > type=Single> ptype=RegExp> pattern=^(RsvpIfStateChange).+> desc=$0> action= add linkDown RsvpIfStateChange> > > type=Single> ptype=RegExp> pattern=^(RsvpIfNbrStateDown).+> desc=$0> action=add linkDown RsvpIfNbrStateDown> > Thanks.> > Raul.> > > > ------------------------------------------------------------------------------ > > > > > ------------------------------------------------------------------------------ > Live Security Virtual Conference > Exclusive live event will cover all the ways today's security and > threat landscape has changed and how IT managers can respond. Discussions > will include endpoint security, mobile security and the latest in malware > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ > > > > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
