Hi,
contexts are global entities which are visible for all rules (the same
applies to most other SEC data structures). The only exception from this
are some actions for manipulating event correlation operations. For
example, 'reset' can only terminate operation started by the rule from the
same file.
The fact that most data are shared by all rules has been the main obstacle
for making SEC multi thread. Also, it is much simpler to run several or
many processes for independent rule sets (that has been also explained in
sec faq http:// simple-evcorr.sourceforge.net/FAQ.html#1)
Kind regards, risto
Hello,
I'm currently working with SEC, and first of all I have to say that it is a
powerful and very understandable correlation engine, and we are lucky Risto
built it.
Nevertheless, i'm facing a problem: if I create a context, will it be
shared between all the configuration files loaded by SEC ?
I'd like to know that because I'm building many rule files, and I would
like an event that does not match any of them to be processed only by the
last one, which is a forward all rule file. But I don't want the events
that match one previous rule to be written by the last, otherwise all the
rule files are useless.
I already know that an event is processed by the files in the ASCII order,
so I named my forward all file zz_forward.conf. And I added a rule in the
top of each other file, which is matched if the event does a negative
match, and creates the NO_MATCH context. In zz_forward.conf, I put a rule
that forward all events, with this context.
But it doesn't work, this is why I'm asking. If needed, I will be able to
put my files here later.
Thanks
Envoyé par mom BlackBerry Orange wireless handheld.
------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
