hi, when a sec process reads its resource file, *all* options from the resource file are appended to its command line options (comment lines and whitespace lines are excluded from consideration). Therefore, when you start several sec instances with the same resource file, each instance has identical command line options (an excerpt from sec dump file):
Program information: ============================================================ Program version: SEC (Simple Event Correlator) 2.7.8 Time of the start: Tue Oct 4 21:39:04 2016 Time of the last configuration load: Tue Oct 4 21:39:04 2016 Time of the dump: Tue Oct 4 21:39:39 2016 Program resource file: /home/risto/secrc Program options: -conf=/etc/sec/app1.sec -input=/var/log/app1.log -conf=/etc/sec/app2.sec -input=/var/log/app2.log -conf=/etc/sec/app3.sec -input=/var/log/app3.log -conf=/etc/sec/app4.sec -input=/var/log/app4.log -conf=/etc/sec/app5.sec -input=/var/log/app5.log -conf=/etc/sec/app6.sec -input=/var/log/app6.log Environment: ============================================================ ... SECRC=/home/risto/secrc In order to address this problem, you need to set up a separate resource file for each instance. Hope this helps, risto 2016-10-04 20:56 GMT+03:00 Yahoo <rahni.wal...@yahoo.com>: > Hello, > > > We have an issue where we are managing several monitors for several > different log files; due to our setup, we need to utilize the resource file > to be able to add the correct configurations i (we used to do this in > /etc/sysconfig/sec with several sec_args[n]=<content> arguments, but we > needed to use the resource file to automate our process) > > > However, we are seeing a problem. > > We have pairs of inputs and config files listed in the resource file. For > example: > > # App1 error monitoring > > -conf=/etc/sec/app1.sec > -input=/var/log/app1.log > > # App2 error monitoring > > -conf=/etc/sec/app2.sec > -input=/var/log/app2.log > > # App3 error monitoring > > -conf=/etc/sec/app3.sec > -input=/var/log/app3.log > > # app4 error monitoring > > -conf=/etc/sec/app4.sec > -input=/var/log/app4.log > > # app5 error monitoring > > -conf=/etc/sec/app5.sec > -input=/var/log/app5.log > > # app6 error monitoring > > -conf=/etc/sec/app6.sec > -input=/var/log/app6.log > > But when we start sec, we get some conf files using the wrong input, for > instance, we get the -conf file for app1 utilizing the input for app2. > > How do we get around this? Is it something to do with the buffer options...? > > We just want each pair only to monitor the input file listed below it. > > > Thank you > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, SlashDot.org! http://sdm.link/slashdot > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
