hi all,
I want to Connecting SEC to MySQL, but when I run "/usr/bin/perl -w
/usr/local/sbin/sec-2.7.5/sec -conf=/etc/snmp/snmptt_test_sec.cfg
-input=/var/log/snmptt/snmptt.log" and "perl ./Db_code.pl" .
My write action in snmptt_test_sec.cfg didn't shown any wrong msg when get
the input, but didn't written to ./SEC_fifo,
# /usr/bin/perl -w /usr/local/sbin/sec-2.7.5/sec
-conf=/etc/snmp/snmptt_test_sec.cfg -input=/var/log/snmptt/snmptt.log
SEC (Simple Event Correlator) 2.7.5
Reading configuration from /etc/snmp/snmptt_test_sec.cfg
7 rules loaded from /etc/snmp/snmptt_test_sec.cfg
Opening input file /var/log/snmptt/snmptt.log
Interactive process, SIGINT can't be used for changing the logging level
Calling code 'CODE(0xe3b820)' and setting variable '%time'
Variable '%time' set to '2014-10-09 10:38:56'
Writing event '3,lossOfSignal' to file SEC_fifo
But ,if I In another window, enter the following:
$ echo blah blah blah >> SEC_fifo
$ echo blah blah blah2 >> SEC_fifo
$ echo quit >> SEC_fifo
which causes the script to read and process the input:
Reading from FIFO...
Got: [blah blah blah], inserted it.
Got: [blah blah blah2], inserted it.
Found a row: id = 1, line = blah blah blah
Found a row: id = 2, line = blah blah blah2
My sec.cfg rule :
type=Single
ptype=Regexp
pattern=(\S+) 10.10.11.15 Loss Of Signal in (\S+)
\(criticalServiceAffecting\),ifIndex=(.+)
desc=TP-15600 Loss of signal events for interface $3 ifIndex=$4
action=lcall %time -> ( sub { my(@time) = localtime(); \
my($timestamp) = sprintf( "%04d-%02d-%02d %02d:%02d:%02d", \
$time[5]+1900, $time[4]+1, $time[3], $time[2], $time[1], $time[0]); \
return $timestamp; } );write SEC_fifo
lossOfSignal,CISCO-15600,$2,%time,Critical,$3
my DB_cod.perl:
#!/usr/bin/perl
#
# Example S8.2.01.pl - Script to read data out of a named pipe
# and write to MySQL database.
#
#
$| = 1;
use strict;
use DBI();
my $filename;
my $inputline;
my $linenumber;
# Open FIFO first. FIFO must already exist.
$filename = "./SEC_fifo";
open(FIFO, "+< $filename") or die "FIFO error on $filename $!";
# Connect to MySQL. Database 'sedb' must already exist.
my $dbh = DBI->connect("DBI:mysql:database=sedb;host=X.X.X.X",
"user", "pwd",
{'RaiseError' => 1});
eval { $dbh->do("DROP TABLE foo") };
print "Dropping table foo failed: $@\n" if $@;
#Create a new table 'foo'. This must not fail, thus we don't
# use eval.
$dbh->do("CREATE TABLE foo (id INTEGER, textline VARCHAR(80))");
print "Reading from FIFO...\n";
while (<FIFO>)
{
$inputline = $_;
# Quit read loop when requested.
last if($inputline =~ /quit/i);
chop $inputline;
$linenumber++;
print "Got: [$inputline]\n ";
# Insert data into table 'foo', using placeholders
# $dbh->do("INSERT INTO foo VALUES (?, ?)",
# undef,
# $linenumber,
# $inputline);
# print "inserted it.\n";
}
# Now retrieve data from the table.
my $sth = $dbh->prepare("SELECT * FROM foo");
$sth->execute();
while (my $ref = $sth->fetchrow_hashref()) {
print "Found a row: id = $ref->{'id'}, line = $ref->{'textline'}\n";
}
# Drop table 'foo'. At this point, table 'foo' exists, so
# we won't use an eval.
$dbh->do("DROP TABLE foo");
$sth->finish();
# Disconnect from the database.
$dbh->do("DROP TABLE foo");
$sth->finish();
# Disconnect from the database.
$dbh->disconnect();
exit;
Thanks,
Andrew
------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
