On 06/05/2012 01:10 PM, Pedro Rafael Alves Simoes wrote: > Hello, > > I have a problem with while reading new lines from a file wih sec. > This is the scenario: > > Log file with lines: > > F, [2012-06-05T10:55:10.096883 #5420] FATAL -- : RESTART_ME > rinda_take: druby://localhost:12345 - #<Errno::ECONNREFUSED: > Connection refused - connect(2)> > F, [2012-06-05T10:55:10.096883 #5420] FATAL -- : RESTART_ME > rinda_take: druby://localhost:12345 - #<Errno::ECONNREFUSED: > Connection refused - connect(2)> > F, [2012-06-05T10:55:10.096883 #5420] FATAL -- : RESTART_ME > rinda_take: druby://localhost:12345 - #<Errno::ECONNREFUSED: > Connection refused - connect(2)> > F, [2012-06-05T10:55:10.096883 #5420] FATAL -- : RESTART_ME > rinda_take: druby://localhost:12345 - #<Errno::ECONNREFUSED: > Connection refused - connect(2)> > F, [2012-06-05T10:55:10.096883 #5420] FATAL -- : RESTART_ME > rinda_take: druby://localhost:12345 - #<Errno::ECONNREFUSED: > Connection refused - connect(2)> > > This 5 lines, always appear in the same second, sometimes interleaved > with other lines. To catch this pattern I wrote a SingleWithThreshold > rule: > > type=SingleWithThreshold > ptype=RegExp > pattern=RESTART_ME > desc=$0 > action=write - RESTART_ME matched.; shellcmd restart_daemon.sh > window=5 > thresh=5 > > This log file is fed by a daemon written in Ruby, using the logger > lib. When the lines arrive, produced by the ruby daemon, sec can't > match them. If I do an echo with all the 5 lines, the sec matches > them. > > For example: > > echo -e "RESTART_ME\nRESTART_ME\nRESTART_ME\nRESTART_ME\nRESTART_ME" >>> logfile.log > > Any idea what seems to be the problem? Maybe flush?
That would be my guess also -- I think these 5 lines are not written instantly, but some of them are kept in a buffer for some time, so sec will not see all 5 events within the same second. Obviously, you have a valid rule which matches the input properly, so apart from buffering issue I can't suspect anything else. with kind regards, risto > > Using sec-2.6.2 > > Thanks, > Pedro > > ------------------------------------------------------------------------------ > Live Security Virtual Conference > Exclusive live event will cover all the ways today's security and > threat landscape has changed and how IT managers can respond. Discussions > will include endpoint security, mobile security and the latest in malware > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
