On Fri, 26 Jul 2013, [email protected] wrote: > Nevertheless, i'm facing a problem: if I create a context, will it be shared > between all the configuration files loaded by SEC ? > > I'd like to know that because I'm building many rule files, and I would like > an event that does not match any of them to be processed only by the last > one, which is a forward all rule file. But I don't want the events that match > one previous rule to be written by the last, otherwise all the rule files > are useless. > I already know that an event is processed by the files in the ASCII order, so > I named my forward all file zz_forward.conf. And I added a rule in the top of > each other file, which is matched if the event does a negative match, and > creates the NO_MATCH context. In zz_forward.conf, I put a rule that forward > all events, with this context. > But it doesn't work, this is why I'm asking. If needed, I will be able to put > my files here later.
My understanding is that each config file is evaluated independantly, so contexts created in one are not found in another. What I would suggest that you do is to have the stuff in one config file create a new log message that it feeds into the logstream that can set the appropriate context for other things. Take a look at this paper http://static.usenix.org/events/lisa10/tech/full_papers/Krizak.pdf They weren't using SEC, but the strategy that they used can be used with SEC. The advantage of this compared to just combining your config files is that this can scale out to multiple instances of SEC, potentially running on multiple machines as needed. David Lang ------------------------------------------------------------------------------ See everything from the browser to the database with AppDynamics Get end-to-end visibility with application monitoring from AppDynamics Isolate bottlenecks and diagnose root cause in seconds. Start your free trial of AppDynamics Pro today! http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
