Hello:
In message <[email protected]>,
saeed salah writes:
> I am trying to find a way to use SEC in an offline mode. I have a huge
> text file of network alerts and I need to create some rules in order
> to make some correlation operations like aggregation and filtering by
> using a predefined time windows. The records have their own create
> and receive times in epoch format. Any help will be appreciated. I
> sercah alot on the Internet but I did not find any documents or
> tutorials discussing SEC in offline mode.
That's because SEC isn't really suitable for offline mode. If you
aren't using any time based rules (e.g Single, Suppress) or contexts,
SEC works fine as a filter. Some correlations such as Pair can be used
to find event pairs, but detecting a missing event or the arrival of
the second event outside of a window is NOT going to work correctly.
What you can do is replay your file of alerts into SEC. When you do
this keep the interval between the messages as indicated by the
(probably receive) timestamps. E.G. if you have two events:
1382108032 event1
1382108033 event2
you could write a script that will emit event1, find the difference in
timing between event1 and event2 (one second in this example), sleep
for that period of time and emit event2.
Then this "replay" script could be used with SEC as:
replay mylogfile | sec --input=- ....
or as:
sh -c 'sleep 10; replay mylogfile >> INFILE ' &
sec --input=INFILE ...
This will make SEC run in realtime but if you are generating a set of
rule for realtime use it works well.
There have been some ideas about how to make SEC operate in
non-realtime mode. They would involve some extensive changes to how
SEC's main loop and time processing works. Because of the difficulty
of changes nobody has tried to do them.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60135031&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
