On Thu, 6 Dec 2012, Risto Vaarandi wrote:
> Currently I've changed the code and have two versions.
> For the first version the output is looking like this:
>
> Rule 1 at line 1 has matched 0 events (ssh event)
> Rule 2 at line 10 has matched 0 events (SSH login failure for $:{SSH:3})
> Rule 3 at line 18 has matched 0 events ($:{SSH2:time}: SSH login event
> for user $:{SSH2:3} from IP $:{SSH:4} type $:{SSH:2})
>
> Nevertheless, for making the "matched" and "events" strings aligned
> across all rows, an extra preliminary loop over the ruleset would be
> required, which would establish the maximum length of the line number
> and match counter. This extra loop is included in the second version:
>
> Rule 1 at line 1 has matched 30 events (ssh event)
> Rule 2 at line 10 has matched 0 events (SSH login failure for $:{SSH:3})
> Rule 3 at line 18 has matched 30 events ($:{SSH2:time}: SSH login event
> for user $:{SSH2:3} from IP $:{SSH:4} type $:{SSH:2})
>
> Which one would you prefer? The second one is easier to grasp for a
> human eye, but some extra CPU time has to be spent.
The first is easier to generate and to parse, but it's not that much harder. I
think the human readability of the second is worth the cost.
David Lang
------------------------------------------------------------------------------
LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
Remotely access PCs and mobile devices and provide instant support
Improve your efficiency, and focus on delivering more value-add services
Discover what IT Professionals Know. Rescue delivers
http://p.sf.net/sfu/logmein_12329d2d
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
