hi Gary, the value for the window field has to be an integer constant. However, suppression of repeated events can also be easily done with contexts, and their lifetimes are freely adjustable. kind regards, risto
2012/11/3 Boyles, Gary P <[email protected]>: > Is there a way to make a window a variable in a “SingleWithSuppress” rule? > > > > I’d like to make the rule “window=” parameter below a variable… where I > could plug in the window-value via code. > > > > I can accomplish what I want with multiple rules, but was just wondering if > there is an easier way. > > > > What I’d like to be able to do… is setup different window values for > different event classes… as the events came in. > > > > Is it possible to have something like window=%mySubReturn (or ???). > > > > Thanks. > > > > Gary Boyles, Intel > > > > > > type=SingleWithSuppress > > continue=TakeNext > > ptype=RegExp > > pattern=(\d+)\s+::\s+(\S+)\s+::\s+(\S+).*$ > > context=($3) -> ( sub { \ > > if ( defined $dup_detect_class_1800{$_[0]} ) { return 1; } \ > > else { return 0; } } ) > > window=1800 > > desc=dup_detect_class_1800_seconds_and_go::$2::$3 > > action=write /sec/log/sec.main.log %u %s > > > ------------------------------------------------------------------------------ > LogMeIn Central: Instant, anywhere, Remote PC access and management. > Stay in control, update software, and manage PCs from one command center > Diagnose problems and improve visibility into emerging IT issues > Automate, monitor and manage. Do more in less time with Central > http://p.sf.net/sfu/logmein12331_d2d > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ LogMeIn Central: Instant, anywhere, Remote PC access and management. Stay in control, update software, and manage PCs from one command center Diagnose problems and improve visibility into emerging IT issues Automate, monitor and manage. Do more in less time with Central http://p.sf.net/sfu/logmein12331_d2d _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
