Hello, I have a problem with while reading new lines from a file wih sec. This is the scenario:
Log file with lines: F, [2012-06-05T10:55:10.096883 #5420] FATAL -- : RESTART_ME rinda_take: druby://localhost:12345 - #<Errno::ECONNREFUSED: Connection refused - connect(2)> F, [2012-06-05T10:55:10.096883 #5420] FATAL -- : RESTART_ME rinda_take: druby://localhost:12345 - #<Errno::ECONNREFUSED: Connection refused - connect(2)> F, [2012-06-05T10:55:10.096883 #5420] FATAL -- : RESTART_ME rinda_take: druby://localhost:12345 - #<Errno::ECONNREFUSED: Connection refused - connect(2)> F, [2012-06-05T10:55:10.096883 #5420] FATAL -- : RESTART_ME rinda_take: druby://localhost:12345 - #<Errno::ECONNREFUSED: Connection refused - connect(2)> F, [2012-06-05T10:55:10.096883 #5420] FATAL -- : RESTART_ME rinda_take: druby://localhost:12345 - #<Errno::ECONNREFUSED: Connection refused - connect(2)> This 5 lines, always appear in the same second, sometimes interleaved with other lines. To catch this pattern I wrote a SingleWithThreshold rule: type=SingleWithThreshold ptype=RegExp pattern=RESTART_ME desc=$0 action=write - RESTART_ME matched.; shellcmd restart_daemon.sh window=5 thresh=5 This log file is fed by a daemon written in Ruby, using the logger lib. When the lines arrive, produced by the ruby daemon, sec can't match them. If I do an echo with all the 5 lines, the sec matches them. For example: echo -e "RESTART_ME\nRESTART_ME\nRESTART_ME\nRESTART_ME\nRESTART_ME" >> logfile.log Any idea what seems to be the problem? Maybe flush? Using sec-2.6.2 Thanks, Pedro ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
