In message <[email protected]>,
Pedro Valera writes:
>I'm wondering if I could force SEC to avoid waiting 10 seconds
>after the thresh has been matched. Currently I notice SEC
>matches 20 patterns and then executes the action but waits 10
>seconds to re-start again the matching, I would like to re-start
>matching right away for other 20 patterns so I don't miss
>information.
>
>type=SingleWithThreshold
>ptype=RegExp
>pattern=DENIED_SCANNING_FROM_([\d.]+)
>desc=Denied scanning from $1.
>action=logonly Repeated denied scan from $1.
>window=10
>thresh=20
SingleWithThreshold's description includes the following sentence:
If the operation has observed N events, it executes the action
list defined by the action field, and consumes all further
matching events without any action.
where N is the "thresh". IIRC it will consume the events for
window seconds, so if you have 20 items in the first 1 second,
the action is triggered and further occurances of the pattern are
consumed for the next window seconds. You can override this by
resetting the rule using the reset action. Something like:
action=logonly Repeated denied scan from $1.; \
reset 0
(Note "reset 0" is the same as "reset 0 %s" or
"reset 0 Denied scanning from $1").
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
Don't let slow site performance ruin your business. Deploy New Relic APM
Deploy New Relic app performance management and know exactly
what is happening inside your Ruby, Python, PHP, Java, and .NET app
Try New Relic at no cost today and get our sweet Data Nerd shirt too!
http://p.sf.net/sfu/newrelic-dev2dev
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
