Re: Multiline in prelude-lml

Ok, maybe an example will help :)
Here my rules :

regex=FirstRule; \
 create_context=FIRST_RULE_MATCHED; \
silent;

regex=SecondRule; \
 require_context=FIRST_RULE_MATCHED; \
silent;

regex=ThirdRule; \
 require_context=FIRST_RULE_MATCHED; \
 destroy_context=FIRST_RULE_MATCHED; \
last;

Then here is my log :

Log1Line 1
Log1Line2
Log1Line3

Log2Line1
Log2Line2 ...

When prelude parse the log, Log1Line1 will match the first rule and then,
create the context. But, prelude will also try to match second and third
rule. When parsing Log1Line2, this line will match secondRule AND thirdRule.
So, what I want to do is to stop prelude-lml trying to match thirdRule if
secondRule has been matched because Log1Line2 will match each, second and
third rule.

This is for scholar purpose, I'm trying to parse java stacktrace...

Thanks.


2008/7/23 Yoann Vandoorselaere <[email protected]>:

> Le mercredi 23 juillet 2008 à 08:40 +0200, bob bob a écrit :
> > I think you misunderstood my problem.
> >
> > When I parse a multiline log, the first rule define a new context but
> don't
> > throw the alert ("silent"). Only the last rule throw the alert using
> "last"
> > keyword. This part is okay.
> > My problem is to tell prelude-lml to stop trying match any rule once it
> has
> > match one. At the moment, when prelude-lml match a rule (ie: the first
> one),
> > it keep trying to match the next ones. This is this behavior that I'd
> like
> > to change.
> >
> > Is there a way of telling prelude "Ok, you have match a rule, then now,
> stop
> > trying to match the next ones, parse the next line"?
>
> My previous answer seems appropriate:
>
> regex=FirstRule; \
> create_context=FIRST_RULE_MATCHED; \
> silent;
>
> regex=SecondRule; \
> require_context=FIRST_RULE_MATCHED; \
> destroy_context=FIRST_RULE_MATCHED; \
> last;
>
> Using the above, SecondRule won't match until FirstRule is matched and
> create the "FIRST_RULE_MATCHED" context.
>
> When SecondRule match, the "FIRST_RULE_MATCHED" context is destroyed,
> and you are back to the initial state (FirstRule need to match before
> SecondRule can be activated).
>
> Isn't that what you are trying to achieve?
> By the way, what product are you trying to write a ruleset for?
>
> Regards,
>
> --
> Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
> Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
> http://www.prelude-ids.com
>
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user