Hello, I'm currently working with SEC, and first of all I have to say that it is a powerful and very understandable correlation engine, and we are lucky Risto built it.
Nevertheless, i'm facing a problem: if I create a context, will it be shared between all the configuration files loaded by SEC ? I'd like to know that because I'm building many rule files, and I would like an event that does not match any of them to be processed only by the last one, which is a forward all rule file. But I don't want the events that match one previous rule to be written by the last, otherwise all the rule files are useless. I already know that an event is processed by the files in the ASCII order, so I named my forward all file zz_forward.conf. And I added a rule in the top of each other file, which is matched if the event does a negative match, and creates the NO_MATCH context. In zz_forward.conf, I put a rule that forward all events, with this context. But it doesn't work, this is why I'm asking. If needed, I will be able to put my files here later. Thanks Envoyé par mom BlackBerry Orange wireless handheld. ------------------------------------------------------------------------------ See everything from the browser to the database with AppDynamics Get end-to-end visibility with application monitoring from AppDynamics Isolate bottlenecks and diagnose root cause in seconds. Start your free trial of AppDynamics Pro today! http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
