Hi all,
I found a solution for the problem of the counter.
The right code:
type=EventGroup
ptype=regexp
pattern=(.*);(.*);(.*);(.*);(.*)(Msg: )(.{20})(.*)
count=lcall %ret $0 -> ( sub { ++$counts{$_[0]}; } )
desc=supress_for_30_sec_$2_$7
action=none
end=lcall %ret $0 -> ( sub { return delete $counts{$_[0]}; } ); \
write /tmp/XXX ($1;$2;$3;$4;\(count:%ret\) $5$6$7$8)
window=30
(Thanks for Risto and the internet archive)
But in this case It's write only the first message in the window and drop
the others:
Messages:
echo "1;1000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
echo "1;1000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
echo "1;2000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
echo "1;2000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
echo "1;2000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
echo "1;3000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
echo "1;2000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
Sec output:
Calling code 'CODE(0x104d728)' and setting variable '%ret'
Variable '%ret' set to '1'
Calling code 'CODE(0x104d728)' and setting variable '%ret'
Variable '%ret' set to '2'
Calling code 'CODE(0x104d728)' and setting variable '%ret'
Variable '%ret' set to '1'
Calling code 'CODE(0x104d728)' and setting variable '%ret'
Variable '%ret' set to '2'
Calling code 'CODE(0x104d728)' and setting variable '%ret'
Variable '%ret' set to '3'
Calling code 'CODE(0x104d728)' and setting variable '%ret'
Variable '%ret' set to '1'
Calling code 'CODE(0x104d728)' and setting variable '%ret'
Variable '%ret' set to '4'
Calling code 'CODE(0x1094b28)' and setting variable '%ret'
Variable '%ret' set to '2'
Writing event '1;1000;3;4;5;6;(count:2) Msg: 12345678901234567890
blahblahblah' to file /tmp/XXX
So the counting is OK now. But what is that last (8th) count? An why does
it output only the first message in the window?
Regards,
Robert
On Wed, Sep 18, 2013 at 7:43 AM, Robert Horvath <[email protected]> wrote:
> Hi all,
>
> I have a small rule wich supresses the same events for 30 sec, but it acts
> strange.
> Here is my rule (I found the sceleton on the net):
>
> type=EventGroup
> ptype=regexp
> pattern=(.*);(.*);(.*);(.*);(.*)(Msg: )(.{20})(.*)
> count=lcall %ret $2 $7 -> ( sub { ++$counts{$_[0]}; } )
> desc=supress_for_30_sec_$2_$7
> action=none
> end=lcall %ret $2 $7 -> ( sub { return delete $counts{$_[0]}; } ); \
> write /tmp/XXX ($1;$2;$3;$4;\(count:%ret\) $5$6$7$8)
> window=30
>
> I started SEC as: sec-2.6.2/sec --detach --conf /tmp/sec.conf
> --input=/tmp/log
>
> After I sent several messages to /tmp/log:
> echo "1;2000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
> (waiting more than 30 sec)
> echo "1;3000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
> echo "1;3000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
> echo "1;3000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
> (waiting more than 30 sec)
> echo "1;2000;3;4;5;6;Msg: 12345678901234567891 blahblahblah" >> /tmp/log
> echo "1;2000;3;4;5;6;Msg: 12345678901234567892 blahblahblah" >> /tmp/log
> echo "1;2000;3;4;5;6;Msg: 12345678901234567893 blahblahblah" >> /tmp/log
>
> I got the following result:
> 1;2000;3;4;5;6;(count:1) Msg: 12345678901234567890 blahblahblah
> 1;3000;3;4;5;6;(count:3) Msg: 12345678901234567890 blahblahblah
> 1;2000;3;4;5;6;(count:3) Msg: 12345678901234567891 blahblahblah
> 1;2000;3;4;5;6;(count:) Msg: 12345678901234567892 blahblahblah
> 1;2000;3;4;5;6;(count:) Msg: 12345678901234567893 blahblahblah
>
> As you can see the count of the 5th message was set to 3, and the others
> were empty.
>
> Can you help me what should be the problem with this rule?
>
> Regards,
> Robert
>
------------------------------------------------------------------------------
LIMITED TIME SALE - Full Year of Microsoft Training For Just $49.99!
1,500+ hours of tutorials including VisualStudio 2012, Windows 8, SharePoint
2013, SQL 2012, MVC 4, more. BEST VALUE: New Multi-Library Power Pack includes
Mobile, Cloud, Java, and UX Design. Lowest price ever! Ends 9/20/13.
http://pubads.g.doubleclick.net/gampad/clk?id=58041151&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
