We are planning to use SEC in offline mode using a huge set of logs.One of the
issues we are trying to write rules for has to do with logic described like
below.1. Check if certain pattern exists “server <n> started”…. and see if
it is followed by another line that says “server <n> started successfully..”2.
If that line is not found, sec needs to now start looking thru the
corresponding server <n> log file (where should I define the mapping between
the server <n> and it’s corresponding log file?)3. And further such logic…
Would I be able to do such complex event co-relation using SEC in the offline
mode? Do I have to pass in all the log files as input to SEC or would merging
all the logs file into one single log file sorted by timestamp work? Is it the
perlfucc rule type I should be using? Does anyone have any example rule sets I
could take a look at?
Thanks,Jyothi
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
