what do you have writing logs to the fifo? remember, that's not a file, it's a connection point. Think of it as the equivalent of | in a shell statement, just showing up on the filesystem.
David Lang On Tue, 11 Feb 2014, andrewarnier wrote: > Hi restro, > When I running /bin/cat /home/Andrew/SEC_fifo It's didn't show anything > > > Andrew > > > -----Original Message----- > From: Risto Vaarandi [mailto:[email protected]] > Sent: Thursday, February 06, 2014 4:54 PM > To: andrewarnier > Cc: [email protected] > Subject: Re: event mail > > 2014-02-06 andrewarnier <[email protected]>: >> Hi restro, >> >> The rule input from my test log , command as follows, >> >> perl /usr/local/sbin/sec.pl -conf=device_sec.cfg --input >> /home/andrew/snmptttest.log >> >> >> >> >> >> type=SingleWithThreshold >> >> ptype=regexp >> >> pattern=(.+) (.+) (.+) (.+) (.+) A Spanning Tree Topology Change at >> (.+)/(.+) on VLAN (\d+) >> >> desc=A Spanning Tree Topology Change flapping flapping event for >> device $4 at $6/$7 on VLAN $8 in 5 seconds >> >> action = pipe ' $1 A Spanning Tree Topology Change flapping flapping >> event for device $4 at $6/$7 on VLAN $8 in 5 seconds at %t' /bin/mail >> -s "A Spanning Tree Topology Change flapping flapping event" >> [email protected] >> >> thresh=2 >> >> window=5 >> >> >> > > have a closer look at your example events and your regular expression: > >> >> >> but when insert two record as follows to my log >> >> Wed Feb 5 14:0240 2014 .1.3.6.1.2.1.17.0.2 Critical "VLAN" >> cisco-7609P - A Spanning Tree Topology Change at Gi2/17 on VLAN 2782 > > in the case of this event, your variables are set as follows: > > $4 = cisco-7609P > $6 = Gi2 > $7 = 17 > $8 = 2782 > >> >> Wed Feb 5 14:02:41 2014 .1.3.6.1.2.1.17.0.2 Critical "VLAN" cisco >> -7609P - A Spanning Tree Topology Change at Gi2/17 on VLAN 2782 >> > > however, in the case of this event, your variables are set as follows: > > $4 = -7609P > $6 = Gi2 > $7 = 17 > $8 = 2782 > >> I have include them in the 'desc' field. But I still receive two A >> Spanning Tree Topology Change flapping flapping event mail, Can you >> give me some advice on what to do please? > > In the case your events were artificial test events, you need to check them > for typos. However, if in your environment device names can indeed contain > whitespace, you would need to match them by looking at the surrounding > characters. > > regards, > risto > >> >> Andrew >> > > > ------------------------------------------------------------------------------ > Android apps run on BlackBerry 10 > Introducing the new BlackBerry 10.2.1 Runtime for Android apps. > Now with support for Jelly Bean, Bluetooth, Mapview and more. > Get your Android app in front of a whole new audience. Start now. > http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ Android apps run on BlackBerry 10 Introducing the new BlackBerry 10.2.1 Runtime for Android apps. Now with support for Jelly Bean, Bluetooth, Mapview and more. Get your Android app in front of a whole new audience. Start now. http://pubads.g.doubleclick.net/gampad/clk?id=124407151&iu=/4140/ostg.clktrk _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
