hi Robert,
since you are using a skeleton from other scenario, you could be facing
multiple issues here. Firstly, you might have issues with parsing, since if
you feed the event
1;2000;3;4;5;6;Msg: 12345678901234567890 blahblahblah
to the regular expression
(.*);(.*);(.*);(.*);(.*)(Msg: )(.{20})(.*)
your parsing result will be
$1 = 1;2000;3
$2 = 4
$3 = 5
$4 = 6
$5 = (empty string)
$6 = Msg:
$7 = 12345678901234567890
This due to the fact that the regular expression has only four delimiting
semicolons, and in order to cope with the situation, the regular expression
matching engine assigns first three fields to $1 variable (it can
legitimately do that, since .* matching sequence of *any* characters,
including semicolons). In order to fix this problem, you should use the
correct number of capturing groups and have them written as ([^;]*) which
prevents the matching of a semicolon.
The other problem with this rule is the scope of event suppression which is
defined by the 'desc' field. Am I correct assuming that you regards events
the same if their 2nd and 7th fields are identical? In other words, are the
following events regarded as identical
1;2000;3;4;5;6;Msg: 12345678901234567890 blahblahblah
1;2000;0;0;0;0;Msg: 12345678901234567890 blahblahblah
since the second field is 2000 and the seventh field is
12345678901234567890 for both events, while the following two
1;2000;3;4;5;6;Msg: 12345678901234567890 blahblahblah
1;2000;3;4;5;6;Msg: 12345678901234567891 blahblahblah
are regarded as different, since the seventh field is different?
Also, given the rule definition I assume that you are trying to store the
count of events for each unique tuple (2nd field, 7th field) during 30
seconds? If so, the problem is the following -- the rule definition you
have starts an event correlation operation for each distinct combination of
two field values, but the counters are stored in the %counts hash only for
each distinct value of the 2nd field. In other words, different event
correlation operations are mistakenly modifying the same counter value. To
fix this, you should change all references $counts{$_[0]} into
$counts{"$_[0] $_[1]"}.
Finally, the skeleton you have chosen as a template looks fairly complex
one if you haven't played with SEC, Perl programming and regular
expressions before. There are many potential caveats here for a beginner
(such as understanding how greedy regular expression matching works), so I
would definitely recommend to have a look into some generic regular
expression tutorials, such as http://perldoc.perl.org/perlretut.html
hope this helps,
risto
2013/9/18 Robert Horvath <[email protected]>
> Hi all,
>
> I have a small rule wich supresses the same events for 30 sec, but it acts
> strange.
> Here is my rule (I found the sceleton on the net):
>
> type=EventGroup
> ptype=regexp
> pattern=(.*);(.*);(.*);(.*);(.*)(Msg: )(.{20})(.*)
> count=lcall %ret $2 $7 -> ( sub { ++$counts{$_[0]}; } )
> desc=supress_for_30_sec_$2_$7
> action=none
> end=lcall %ret $2 $7 -> ( sub { return delete $counts{$_[0]}; } ); \
> write /tmp/XXX ($1;$2;$3;$4;\(count:%ret\) $5$6$7$8)
> window=30
>
> I started SEC as: sec-2.6.2/sec --detach --conf /tmp/sec.conf
> --input=/tmp/log
>
> After I sent several messages to /tmp/log:
> echo "1;2000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
> (waiting more than 30 sec)
> echo "1;3000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
> echo "1;3000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
> echo "1;3000;3;4;5;6;Msg: 12345678901234567890 blahblahblah" >> /tmp/log
> (waiting more than 30 sec)
> echo "1;2000;3;4;5;6;Msg: 12345678901234567891 blahblahblah" >> /tmp/log
> echo "1;2000;3;4;5;6;Msg: 12345678901234567892 blahblahblah" >> /tmp/log
> echo "1;2000;3;4;5;6;Msg: 12345678901234567893 blahblahblah" >> /tmp/log
>
> I got the following result:
> 1;2000;3;4;5;6;(count:1) Msg: 12345678901234567890 blahblahblah
> 1;3000;3;4;5;6;(count:3) Msg: 12345678901234567890 blahblahblah
> 1;2000;3;4;5;6;(count:3) Msg: 12345678901234567891 blahblahblah
> 1;2000;3;4;5;6;(count:) Msg: 12345678901234567892 blahblahblah
> 1;2000;3;4;5;6;(count:) Msg: 12345678901234567893 blahblahblah
>
> As you can see the count of the 5th message was set to 3, and the others
> were empty.
>
> Can you help me what should be the problem with this rule?
>
> Regards,
> Robert
>
>
> ------------------------------------------------------------------------------
> LIMITED TIME SALE - Full Year of Microsoft Training For Just $49.99!
> 1,500+ hours of tutorials including VisualStudio 2012, Windows 8,
> SharePoint
> 2013, SQL 2012, MVC 4, more. BEST VALUE: New Multi-Library Power Pack
> includes
> Mobile, Cloud, Java, and UX Design. Lowest price ever! Ends 9/20/13.
> http://pubads.g.doubleclick.net/gampad/clk?id=58041151&iu=/4140/ostg.clktrk
> _______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
>
------------------------------------------------------------------------------
LIMITED TIME SALE - Full Year of Microsoft Training For Just $49.99!
1,500+ hours of tutorials including VisualStudio 2012, Windows 8, SharePoint
2013, SQL 2012, MVC 4, more. BEST VALUE: New Multi-Library Power Pack includes
Mobile, Cloud, Java, and UX Design. Lowest price ever! Ends 9/20/13.
http://pubads.g.doubleclick.net/gampad/clk?id=58041151&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
