2014-07-24 6:06 GMT+03:00 Yuheng Du <[email protected]>:
> Yes, you are right.
>
> ># put two matching events in within 10 seconds
>
> >"deploymentId" => foodeployment#(sd2)",
> >"deploymentId" => foodeployment#(sd2)",
>
> I hope the second event will trigger the end action, too. How can I do
> that?
>
the second event will not trigger the 'end' action, since the operation
does not terminate when the second event has been observed. After executing
action list defined with the 'action' field, the operation will continue to
exist until its event correlation window expires (all further events that
this particular operation sees are consumed silently).
> I am using the following rule now:
>
> type=EventGroup
> ptype=RegExp
> thresh=2
> window=10
> pattern=\"deploymentId\"\s+=>\s+(\S+)deployment#(\S+)\",
> desc=CHECK_INTERVAL_$2
> action=assign %deploymentId $2;\
> create deploymentId_$2;\
> create DEPLOYMENTID_CONTEXT;\
> write - $2 heart beats heard within 10s.
> slide=reset 0 %s;
> end=write - $2 not heard for 10s since last receive event.
>
> I am not sure if the slide action will do what I expected it to do.
>
Since in your case thresh=2, the actions given with the 'slide' field will
never be executed. For your rule definition, window sliding can only happen
if an operation that has been started by this rule has seen only 1 event
and the event correlation window of 10 seconds has expired. However, since
there is only 1 event in the current window, sliding is not possible, since
there are no other events with later timestamps within the window (sliding
involves moving the beginning of the window to the timestamp of the later
event). Since sliding is not possible with thresh=2, each operation with
such a threshold will always terminate when the event correlation window
expires, and thus the 'end' action is always executed.
kind regards,
risto
>
> Thanks.
>
> Yuheng
>
>
> On Wed, Jul 23, 2014 at 11:01 PM, John P. Rouillard <[email protected]>
> wrote:
>
>>
>> Hello:
>>
>> In message
>> <cadjfwj0pvlesvf1eocv+s316coj3kllepuhy_oqqnndvjjx...@mail.gmail.com> ,
>>
>> Yuheng Du writes:
>>
>> >I was using the event group method to check the interval between events.
>> So
>> >I use:
>> >
>> >type=EventGroup
>> >ptype=RegExp
>> >thresh=2
>> >window=10
>> >pattern=\"deploymentId\"\s+=>\s+(\S+)deployment#(\S+)\",
>> >desc=CHECK_INTERVAL_$2
>> >action=assign %deploymentId $2;\
>> > create deploymentId_$2;\
>> > create DEPLOYMENTID_CONTEXT;\
>> > reset 0 %s;\
>> >write - $2 heart beats heard within 10s.
>> >end=write - $2 not heard for 10s since last receive event.
>> >
>> >When I sent two events within 10s:
>> >
>> >"deploymentId" => dsrgdeployment#srb_2",
>> >"deploymentId" => dsrgdeployment#srb_2",
>> >
>> >It gives me : "srb_2 heart beats heard within 10s".
>>
>> Exactly as it should. The action triggered and wrote out the message.
>>
>>
>> >But the second event did not trigger an end action like "srb_2 not heard
>> >for 10s since last receive event", which I hope it should do.
>>
>> Only the first event with no second event within 10 seconds should
>> trigger the end action. Did you wait long enough?
>>
>> It works for me with test.sec containg the rule above.
>>
>> ~/tmp> /tools/sec/bin/sec -conf test.sec -input -
>> SEC (Simple Event Correlator) 2.7.2
>> Reading configuration from test.sec
>> 1 rules loaded from test.sec
>> Opening input file -
>> Stdin connected to terminal, SIGINT can't be used for changing the
>> logging level
>>
>> # put two matching events in within 10 seconds
>>
>> "deploymentId" => foodeployment#(sd2)",
>> "deploymentId" => foodeployment#(sd2)",
>>
>>
>> Assigning '(sd2)' to variable '%deploymentId'
>> Creating context 'deploymentId_(sd2)'
>> Creating context 'DEPLOYMENTID_CONTEXT'
>> Terminating event correlation operation 'test.sec | 0 |
>> CHECK_INTERVAL_(sd2)'
>> Writing event '(sd2) heart beats heard within 10s.' to file -
>> (sd2) heart beats heard within 10s.
>>
>> # ^^^ this is all your action rule triggered as expected.
>>
>> # wait 30 seconds just to make sure the end is NOT triggered.
>> # the end was NOT triggered as we want
>>
>> # put in just one event
>>
>> "deploymentId" => foodeployment#(sd2)",
>> Writing event '(sd2) not heard for 10s since last receive event.' to file
>> -
>> (sd2) not heard for 10s since last receive event.
>> # ^^ as we wanted if there is no second rule, report the end condition
>>
>> --
>> -- rouilj
>> John Rouillard
>>
>> ===========================================================================
>> My employers don't acknowledge my existence much less my opinions.
>>
>
>
>
> ------------------------------------------------------------------------------
> Want fast and easy access to all the code in your enterprise? Index and
> search up to 200,000 lines of code with a free copy of Black Duck
> Code Sight - the same software that powers the world's largest code
> search on Ohloh, the Black Duck Open Hub! Try it now.
> http://p.sf.net/sfu/bds
> _______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
>
------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
