hi Gary,
the 'continue' and 'continue2' parameters specify that the event should be
passed to the following rules after the pattern has matched and the rule
has processed for the event. Here the processing means only immediate
activities, and everything which takes time is done asynchronously. For
example, if the SingleWithScript rule starts an external program for
matching the event, sec does not wait for the completion of the program,
but immediately passes the event to the following rule if
continue=TakeNext. Likewise, the window parameter of the PairWithWindow
rule has no effect on continue parameter. However, one should consider that
under some circumstances processing the event can take time which
influences continue. For example, if one uses the 'eval %o sleep 5' action
in the Single rule, this will freeze the sec process for 5 seconds, and the
event will passed further only after this delay.
kind regards,
risto
2013/4/12 Boyles, Gary P <[email protected]>
> All,
>
> When using "PairWithWindow"...
>
> When an event has matched the conditions defined by the pattern and
> context field, does the
> "continue" or "continue2" take effect immediately?
>
> That is, does the event-processing continue immediately, or does the
> event-processing
> stop until after the window-time elapses (e.g. 120 seconds)?
>
> For example...
>
> I have a PairWithWindow rule with a window=120, and continue=TakeNext. I
> send in an event
> that matches the regex, and the context.
>
> Immediately after that rule, I have a rule that prints to the log-file
> "Hello".
>
> Does the "hello" get printed out immediately, or will it appear 120
> seconds after the PairWithWindow
> rule?
>
> Thanks.
>
> Gary Boyles
>
>
> ------------------------------------------------------------------------------
> Precog is a next-generation analytics platform capable of advanced
> analytics on semi-structured data. The platform includes APIs for building
> apps and a phenomenal toolset for data science. Developers can use
> our toolset for easy data analysis & visualization. Get a free account!
> http://www2.precog.com/precogplatform/slashdotnewsletter
> _______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
------------------------------------------------------------------------------
Precog is a next-generation analytics platform capable of advanced
analytics on semi-structured data. The platform includes APIs for building
apps and a phenomenal toolset for data science. Developers can use
our toolset for easy data analysis & visualization. Get a free account!
http://www2.precog.com/precogplatform/slashdotnewsletter
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
