The use of 'eval' action is indeed another way, but unlike 'lcall' action,
'eval' involves recompilation of Perl code before each execution. However,
that might become quite expensive if the rule will match large number of
events. For that reason, I'd recommend to use 'lcall', since the event
timestamp can be passed into a perl function in a straightforward way.
risto
2014-11-21 22:26 GMT+02:00 MILLS, ROCKY <[email protected]>:
> Hi Andrew,
>
>
>
> You can use ‘eval’ action to reformat the $1 timestamp. Same perl code
> (except you need %% for month_hash):
>
>
>
> eval %time ( my $str = "$1";\
>
> my
> @months=('jan','feb','mar','apr','may','jun','jul','aug','sep','oct','nov','dec');\
>
> my ($day,$mon,$date,$year,$time) = split(' ',lc($str));\
>
> my %%month_hash;\
>
> @month_hash{@months} = (1 .. 12);\
>
> return "$year-$month_hash{$mon}-$date $time";\
>
> )
>
>
>
> Regards,
>
> Rock
>
>
>
> *From:* andrewarnier [mailto:[email protected]]
> *Sent:* Friday, November 21, 2014 1:26 AM
> *To:* [email protected]
> *Subject:* [Simple-evcorr-users] how to get pattern variable $1 to action
> ?
>
>
>
> Hi all,
>
> I want to get the trap time ,but the trap time format is “Fri Nov 21 2014
> 15:04:32” ,how to change the format to “2014-11-21 15:04:32” in my single
> rule ?
>
>
>
> I try to convert the datetime format in my sec fule, but my rule action
> can’t get the variable $1,
>
> Anyone knows what’s wrong with my rule ? how to fix ?
>
>
>
>
>
>
>
> type=Single
>
> ptype=Regexp
>
> pattern=(\S+) .1.3.6.1.4.1.3607.2.20.0.430 192.168.11.15 Loss Of Signal in
> (\S+) \(criticalServiceAffecting\),ifIndex=(.+)
>
> desc= CA -15600 Loss of signal events for interface $2($3)
>
> action=lcall %time -> ( sub { my $str = '$1';\
>
> my @months
> =('jan','feb','mar','apr','may','jun','jul','aug','sep','oct','nov','dec');\
>
> my ($day,$mon,$date,$year,$time) = split(' ',lc($str));\
>
> my %month_hash;\
>
> @month_hash{@months} = (1 .. 12);\
>
> return "$year-$month_hash{$mon}-$date $time"; } );shellcmd
> /home/andrew/code/sendmail.sh "Loss Of Signal" "CA-15600 Loss of signal
> events for interface $2($3)" "%time"
>
>
>
>
>
>
>
>
>
> cheers,
>
> Andrew
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> _______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
>
------------------------------------------------------------------------------
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
