Thanks! ☺ risto
From: Noel Athaide [mailto:athai...@gmail.com] Sent: Thursday, November 05, 2015 7:25 PM To: simple-evcorr-users@lists.sourceforge.net Subject: Re: [Simple-evcorr-users] invalid action error Oh you guessed right... I installed as a package from Ubuntu software center not realizing that it's not the latest version. Thanks, your solution (unpack + copy) fixed it. Btw... AWESOME tool! Noel. On Thu, Nov 5, 2015 at 2:13 PM, Risto Vaarandi <risto.vaara...@gmail.com<mailto:risto.vaara...@gmail.com>> wrote: hi Noel, you are seeing this error message since the sec version is too old. The 'getsize' action is supported in all 2.7.X versions, while your version appears to be 2.5.3. Since sec-2.5.X has been followed by two major versions (2.6 and 2.7) which add a lot of new functionality, I would definitely recommend to upgrade to 2.7. If sec-2.5.3 was installed from a package and there is no recent version available in the package repository, it is fortunately very easy to install the newer version from sources -- just unpack the source tarball and copy the 'sec' file to /usr/local/bin. (Cleaning the custom installation later would just involve removing that file.) Hope this helps, risto 2015-11-05 7:50 GMT+02:00 Noel Athaide <athai...@gmail.com<mailto:athai...@gmail.com>>: Hi Folks, I'm new to SEC and am trying a single simple rule which will just add each event containing the text 'AAA' to a context store and then print out the size of the context store each time. (contents of file test-sec.rules) type=Single ptype=SubStr pattern=AAA desc=Three A characters action=add C1 AAA ; getsize %size C1; write - context store size = %size When I run SEC, I get 'invalid action getsize' error: $ sec --input=- --conf=./test-sec.rules SEC (Simple Event Correlator) 2.5.3 Reading configuration from ./test-sec.rules Rule in ./test-sec.rules at line 1: Invalid action 'getsize %size C1' Rule in ./test-sec.rules at line 1: Invalid action list ' add C1 AAA ; getsize %size C1; write - context store size = %size ' No valid rules found in configuration file ./test-sec.rules Stdin connected to terminal, SIGINT can't be used for changing the logging level It's probably something obvious, but I can't seem to figure out what is causing the error. I searched the mailing lists, but only found old version of SEC as a possible cause. I am using the latest version here. Pl. help. Thanks, Noel. ------------------------------------------------------------------------------ _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net<mailto:Simple-evcorr-users@lists.sourceforge.net> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
------------------------------------------------------------------------------
_______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
