On Sat, 15 Sep 2012, Risto Vaarandi wrote: > > 2012/9/15 <da...@lang.hm>: >> On Fri, 14 Sep 2012, Boyles, Gary P wrote: >> >>> Can someone point me to documentation that describes context and desc? >>> >>> There seems to be more uses for it that I can find documentation on. >> >> the tutorials linked to from the SEC page do a pretty good job of covering >> them. >> >> short version: >> >> desc is used to track this rule inside SEC, if it has variables in it, >> each value is treated separately (when considering things like threshold >> counts, etc). 'odd' things happen if you have multiple rules in a file >> that have the same desc value. >> > > Actually, several rules in one file *can* have the same desc value > without any issues. The 'desc' field defines *part* of the ID of event > correlation operation which is started by the rule (but not the whole > ID!). As a consequence, if 'desc' contains variables, one rule can > start several operations with different IDs. In order to avoid clashes > between operations started by different rules, operation IDs also > contain > 1) the rule file name, > 2) the rule number inside the given file. > This technical detail is not mentioned in the introductory examples at > the beginning of the man page, but rather in a later section which > provides full discussion on the issue: > http://simple-evcorr.sourceforge.net/man.html#EVENT%20CORRELATION%20OPERATIONS
Thanks for the clarification, I did not understand that (even after having gone through a full-day tutorial on SEC at LISA) David Lang ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://ad.doubleclick.net/clk;258768047;13503038;j? http://info.appdynamics.com/FreeJavaPerformanceDownload.html _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
