Hi,
I'm using SingleWithSuppress to suppress events. However, I want to ignore the
message (normally in $7) in this determination.
Currently, it seems to take the entire line into account.
Is there a way to discount the message? What I want to do is only report one
event for each node ($2) and each "class" ($3).
In the example the class is APP_XYZ. Message is text "My Dog Has...".
Is there a way of structuring the Regex so that this will work? Otherwise, it
comes down to context perl code.
My input-format and my rule are listed below.
Thanks.
Gary Boyles, Intel
Input Events:
1351784591 :: fmssrvdev002 :: APP_XYZ :: myXYZ :: CRITICAL :: NOTIFY :: My Dog
Has Flees (994)
1351784591 :: fmssrvdev002 :: APP_XYZ :: myXYZ :: CRITICAL :: NOTIFY :: My Dog
Has Flees (995)
1351784591 :: fmssrvdev002 :: APP_XYZ :: myXYZ :: CRITICAL :: NOTIFY :: My Dog
Has Flees (996)
1351784591 :: fmssrvdev002 :: APP_XYZ :: myXYZ :: CRITICAL :: NOTIFY :: My Dog
Has Flees (997)
1351784591 :: fmssrvdev002 :: APP_XYZ :: myXYZ :: CRITICAL :: NOTIFY :: My Dog
Has Flees (998)
1351784591 :: fmssrvdev002 :: APP_XYZ :: myXYZ :: CRITICAL :: NOTIFY :: My Dog
Has Flees (999)
Rule:
type=SingleWithSuppress
continue=TakeNext
ptype=RegExp
pattern=(\d+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(\S+).*$
context=($3) -> ( sub { \
if ( defined $dup_detect_class_300{$_[0]} ) { return 1; } \
else { return 0; } } )
window=300
desc=dup_detect_class_300_sec_And_Go :: $0
action=write /sec/log/sec.main.log %u %s
Just as an FYI... the $dup_detect_class_300 array has an entry for APP_XYZ.
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_sfd2d_oct
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
