Oh you guessed right... I installed as a package from Ubuntu software center not realizing that it's not the latest version. Thanks, your solution (unpack + copy) fixed it.
Btw... AWESOME tool! Noel. On Thu, Nov 5, 2015 at 2:13 PM, Risto Vaarandi <risto.vaara...@gmail.com> wrote: > hi Noel, > > you are seeing this error message since the sec version is too old. The > 'getsize' action is supported in all 2.7.X versions, while your version > appears to be 2.5.3. Since sec-2.5.X has been followed by two major > versions (2.6 and 2.7) which add a lot of new functionality, I would > definitely recommend to upgrade to 2.7. > > If sec-2.5.3 was installed from a package and there is no recent version > available in the package repository, it is fortunately very easy to install > the newer version from sources -- just unpack the source tarball and copy > the 'sec' file to /usr/local/bin. (Cleaning the custom installation later > would just involve removing that file.) > > Hope this helps, > risto > > 2015-11-05 7:50 GMT+02:00 Noel Athaide <athai...@gmail.com>: > >> Hi Folks, >> I'm new to SEC and am trying a single simple rule which will just add >> each event containing the text 'AAA' to a context store and then print out >> the size of the context store each time. >> >> (contents of file *test-sec.rules*) >> type=Single >> ptype=SubStr >> pattern=AAA >> desc=Three A characters >> action=add C1 AAA ; getsize %size C1; write - context store size = %size >> >> When I run SEC, I get '*invalid action* *getsize*' error: >> $ sec --input=- --conf=./test-sec.rules >> SEC (Simple Event Correlator) *2.5.3* >> Reading configuration from ./test-sec.rules >> Rule in ./test-sec.rules at line 1: *Invalid action 'getsize %size C1'* >> Rule in ./test-sec.rules at line 1: Invalid action list ' add C1 AAA ; >> getsize %size C1; write - context store size = %size ' >> No valid rules found in configuration file ./test-sec.rules >> Stdin connected to terminal, SIGINT can't be used for changing the >> logging level >> >> >> It's probably something obvious, but I can't seem to figure out what is >> causing the error. I searched the mailing lists, but only found old version >> of SEC as a possible cause. I am using the latest version here. >> >> Pl. help. Thanks, >> Noel. >> >> >> ------------------------------------------------------------------------------ >> >> _______________________________________________ >> Simple-evcorr-users mailing list >> Simple-evcorr-users@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users >> >> >
------------------------------------------------------------------------------
_______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
