Hi guys,
I made two rules, I extract some information and assign it to an variable
in the first rule. How can I use the variable in the second rule? Here are
my two rules:
#Rule 1: extract the deploymentId from log and assign it to variable %
deploymentId.
type=Single
ptype=RegExp
desc=$0
pattern=\"deploymentId\"\s+=>\s+(\S+)deployment#(\S+)\",
action=assign %deploymentId $2;\
create DEPLOYMENTID_CONTEXT;
#Rule 2: try to use %deploymentId value in the pattern expression.
type=Single
ptype=RegExp
pattern=status\s+of\s+(%deploymentId)\s+to\s+dead
desc=CHECK_DEAD
action=write - %deploymentId dead notified.
SEC does not recognize the variable's value in my Rule 2's pattern. Can
anyone help me with it?
Thanks,
Yuheng
------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
