hi Gary, the scope of event suppression is entirely set with the 'desc' field of the rule. Each time a new event comes in, 'desc' is evaluated and combined with the rule file name and rule number. If there is an event correlation operation already running for the resulting value, event is consumed by this operation, otherwise a new operation is started. Since you have used $0 in 'desc' which equals to entire line, each unique line will create a new suppression operation. There is also a section discussing this matter in the official documentation: http://simple-evcorr.sourceforge.net/man.html#EVENT%20CORRELATION%20OPERATIONS The regular expression itself seems to work properly to me -- I'd use the ^ anchor for ensuring that the matching starts from the begininng of the line: ^(\d+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(\S+) with kind regards, risto
2012/11/1 Boyles, Gary P <[email protected]>: > Hi, > > I’m using SingleWithSuppress to suppress events. However, I want to ignore > the message (normally in $7) in this determination. > > Currently, it seems to take the entire line into account. > > > > Is there a way to discount the message? What I want to do is only report > one event for each node ($2) and each “class” ($3). > > In the example the class is APP_XYZ. Message is text “My Dog Has…”. > > > > Is there a way of structuring the Regex so that this will work? Otherwise, > it comes down to context perl code. > > > > My input-format and my rule are listed below. > > > > Thanks. > > > > Gary Boyles, Intel > > > > Input Events: > > 1351784591 :: fmssrvdev002 :: APP_XYZ :: myXYZ :: CRITICAL :: NOTIFY :: My > Dog Has Flees (994) > > 1351784591 :: fmssrvdev002 :: APP_XYZ :: myXYZ :: CRITICAL :: NOTIFY :: My > Dog Has Flees (995) > > 1351784591 :: fmssrvdev002 :: APP_XYZ :: myXYZ :: CRITICAL :: NOTIFY :: My > Dog Has Flees (996) > > 1351784591 :: fmssrvdev002 :: APP_XYZ :: myXYZ :: CRITICAL :: NOTIFY :: My > Dog Has Flees (997) > > 1351784591 :: fmssrvdev002 :: APP_XYZ :: myXYZ :: CRITICAL :: NOTIFY :: My > Dog Has Flees (998) > > 1351784591 :: fmssrvdev002 :: APP_XYZ :: myXYZ :: CRITICAL :: NOTIFY :: My > Dog Has Flees (999) > > > > Rule: > > type=SingleWithSuppress > > continue=TakeNext > > ptype=RegExp > > pattern=(\d+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(\S+).*$ > > context=($3) -> ( sub { \ > > if ( defined $dup_detect_class_300{$_[0]} ) { return 1; } \ > > else { return 0; } } ) > > window=300 > > desc=dup_detect_class_300_sec_And_Go :: $0 > > action=write /sec/log/sec.main.log %u %s > > > > > > Just as an FYI… the $dup_detect_class_300 array has an entry for APP_XYZ. > > > > > ------------------------------------------------------------------------------ > Everyone hates slow websites. So do we. > Make your web apps faster with AppDynamics > Download AppDynamics Lite for free today: > http://p.sf.net/sfu/appdyn_sfd2d_oct > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
