2012/10/19 Boyles, Gary P <[email protected]>:
> Hi,
>
> I’ve got a question about creating and using % variables in my rules.
>
>
>
> I was under the impression that the %variable contents were accessible from
> other rules if in the same configuration file.
hi Gary,
the variables which the user can create in action lists are visible
only in action lists of other rules (that's why they are called action
list variables). They are implemented in this way, because match
variables are substituted immediately after the match, while action
list variable substitution takes places immediately before the action
is triggered. This is so because inside action list, the execution
often changes the content of variables, and later actions rely on
values set by earlier actions. Moreover, variables carrying timestamps
(%t and %u) would be more meaningful inside action list if they
reflect the current time during the list execution.
Unfortunately, the time moments of the pattern match and the action
list execution are the same only for Single and few other rules, while
in other cases like SingleWithThreshold there could be substantial gap
between these moments. In order to have action list variables
implemented for context expressions, we would therefore need two
rounds of substitutions for these variables, and one variable could
carry a different value in the same rule definition. That would be
quite confusing :(
If you would like to pass some data from one rule into the context
expression of the other, I would recommend Perl data structures. In
the case your ruleset example, it is the only way, since the context
function is compiled only once at SEC startup. Thus, it is impossible
to substitute %dc_pod at runtime in this function.
hope this helps,
risto
>
>
>
> Is this not the case?
>
>
>
> Rule #1: Create variable %dc_pod and load with node::POD1. (Example #1
> Below)
>
> ==================================================
>
> if the node was gpb001, then %dc_pod = gpb001::POD1. This all seems to be
> fine, because (in rule #1)
>
> The sec.log file contains the entry – timestamp gpb001::POD1
>
>
>
> Rule #2: Use %dc_pod and print out values (Example #2 Below)
>
> ===================================
>
> In the context for the 2nd-rule, I’m trying to use the previously set
> %dc_pod variable, and pass the variables value into the subroutine,
>
> Have the variables printed, and set the return.
>
>
>
> In this case… %dc_pod value does not seem to be set at all. The name itself
> (%dc_pod) is passed in.
>
>
>
> Question… can user-defined % variable values be used in multiple/sequential
> rules?
>
>
>
> If so… what am I doing wrong?
>
>
>
> Now… I know I can use global variables (i.e. $podResult), but that doesn’t
> seem like a good practice.
>
>
>
> Summary: %dc_pod values do not seem to be retained between rules. Is this
> by design?
>
>
>
> Thanks for the help !!!
>
>
>
> (Examples Below)
>
>
>
> Gary Boyles
>
>
>
> Example Code:
>
> ============
>
> type=Single
>
> continue=TakeNext
>
> ptype=RegExp
>
> pattern=(\d+)\s+::\s+(\S+)\s+::\s+(PLT|INF).*\s+::\s+(\S+)\s+::\s+(DOWN|UNREACHABLE).*$
>
> context=!POD_TABLE_LOOKUP::$2
>
> desc=POD_TABLE_LOOKUP::$2
>
> action=lcall %dc_pod $2 -> ( sub { \
>
> my ($myNode) = $_[0]; \
>
> $podResult = "$myNode"."::"."POD1"; \
>
> return("$podResult"); \
>
> } );write /sec/log/sec.log %u %dc_pod
>
>
>
>
>
> type=Single
>
> continue=DontCont
>
> ptype=RegExp
>
> pattern=(\d+)\s+::\s+(\S+)\s+::\s+(PLT|INF).*\s+::\s+(\S+)\s+::\s+(DOWN|UNREACHABLE).*$
>
> context=($2 %dc_pod) -> (sub { if ($_[0] =~ /$_[1]/ && $_[1] =~
> /pod_down|pod_low/i) \
>
> { \
>
> print "0> 0 = $_[0]\n"; \
>
> print "0> 1 = $_[1]\n"; \
>
> print "0> dc = %dc_pod \n"; \
>
> print "0> pod = $podResult \n"; \
>
> return 1; \
>
> } \
>
> else \
>
> { \
>
> print "1> 0 = $_[0]\n"; \
>
> print "1> 1 = $_[1]\n"; \
>
> print "1> dc = %dc_pod \n"; \
>
> print "1> pod = $podResult \n"; \
>
> return 0; \
>
> } })
>
> desc=POD_TABLE_INCIDENT::%dc_pod
>
> action=write %u %s
>
>
>
>
> ------------------------------------------------------------------------------
> Everyone hates slow websites. So do we.
> Make your web apps faster with AppDynamics
> Download AppDynamics Lite for free today:
> http://p.sf.net/sfu/appdyn_sfd2d_oct
> _______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_sfd2d_oct
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
