Hi,
I've been trying to get an environment-variable to work in a write statement,
and it doesn't seem to work.
This is on Ubuntu.
Should this work somehow?
Thanks.
This works:
=========
type=Single
continue=DontCont
ptype=RegExp
pattern=(\d+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(UNKNOWN).*$
desc=SUPPRESS_UNKNOWN_SEV_EVENTS_FROM_NODE::$2
action=write /sec/log/sec.suppress.log %u %s
This Does Not:
============
type=Single
continue=DontCont
ptype=RegExp
pattern=(\d+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(\S+)\s+::\s+(UNKNOWN).*$
desc=SUPPRESS_UNKNOWN_SEV_EVENTS_FROM_NODE::$2
action=write $SEC_LOG/sec.suppress.log %u %s
Prior to starting script I define and export SEC_LOG
Thanks for the help.
------------------------------------------------------------------------------
Free Next-Gen Firewall Hardware Offer
Buy your Sophos next-gen firewall before the end March 2013
and get the hardware for free! Learn more.
http://p.sf.net/sfu/sophos-d2d-feb
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
