Hi,
Thank you for your answers. I used John's "standard preamble" and last 99
file strategy, and it worked. Actually I was doing it wrong : instead of
checking in the last 99file if an event had been taken care of by another
ruleset with an EVENT_PROCESSED context in the other rules, I was checking
in each rule if the event had to be handle by setting a NO_PROCESSED_EVENT
context if not.
I will look into making a script to run multiple instances of SEC as
advised by Risto if there is real gain of performance.
Thanks again
--
Emile RÉ,
Élève-ingénieur à l'École Centrale de Lille
2013/7/27 Risto Vaarandi <[email protected]>
> Hi,
> contexts are global entities which are visible for all rules (the same
> applies to most other SEC data structures). The only exception from this
> are some actions for manipulating event correlation operations. For
> example, 'reset' can only terminate operation started by the rule from the
> same file.
> The fact that most data are shared by all rules has been the main obstacle
> for making SEC multi thread. Also, it is much simpler to run several or
> many processes for independent rule sets (that has been also explained in
> sec faq http:// simple-evcorr.sourceforge.net/FAQ.html#1)
> Kind regards, risto
> Hello,
>
> I'm currently working with SEC, and first of all I have to say that it is
> a powerful and very understandable correlation engine, and we are lucky
> Risto built it.
>
> Nevertheless, i'm facing a problem: if I create a context, will it be
> shared between all the configuration files loaded by SEC ?
>
> I'd like to know that because I'm building many rule files, and I would
> like an event that does not match any of them to be processed only by the
> last one, which is a forward all rule file. But I don't want the events
> that match one previous rule to be written by the last, otherwise all the
> rule files are useless.
> I already know that an event is processed by the files in the ASCII order,
> so I named my forward all file zz_forward.conf. And I added a rule in the
> top of each other file, which is matched if the event does a negative
> match, and creates the NO_MATCH context. In zz_forward.conf, I put a rule
> that forward all events, with this context.
> But it doesn't work, this is why I'm asking. If needed, I will be able to
> put my files here later.
>
> Thanks
> Envoyé par mom BlackBerry Orange wireless handheld.
>
> ------------------------------------------------------------------------------
> See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
> _______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
------------------------------------------------------------------------------
Get your SQL database under version control now!
Version control is standard for application code, but databases havent
caught up. So what steps can you take to put your SQL databases under
version control? Why should you start doing it? Read more to find out.
http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
