Thank you for the patch. The current dev branch has moved the autocat information into the database and the autocat.conf has been depreciated.

Bamm


On Fri, Jan 24, 2014 at 3:10 AM, Cyrille Bollu <cyrille.bollu@gmail.com> wrote:
Hi,

I've found a problem in the way sguild parses autocat.conf: "|" is not allowed in %%REGEX%%.

The reason is that sguild uses [ctoken line "||"] to get the fields one by one. And, ctoken splits strings based on single character only.

As a result, "|" is not allowed in %%REGEX%%.

Here's a patch to this problem:

proc RemoveAutoCatRule { rid } {
  global acRules acCat
  LogMessage "Removing Rule: $acRules($rid)"
  unset acRules($rid)
  unset acCat($rid)
}

# Cyrille: Start patch
proc mcsplit "str splitStr {mc {\x00}}" {
    return [lindex [split [string map [list $splitStr $mc] $str] $mc] 1]
}
# Cyrille: End patch

proc AddAutoCatRule { line rid } {
    global acRules acCat
    InfoMessage "Adding AutoCat Rule: $line"
    # dIndex are the indexes within each data line
    # that we want to look at.
    foreach dIndex [list 3 8 11 9 12 10 7] {
        # Next field in the rule
# Cyrille: Start patch
        set tmpVar [mcsplit $line "||"]
        set line [string range $line [expr {[string first "||" $line 3]}] end]
#       set tmpVar [ctoken line "||"]
# Cyrille: End patch

        # All the fields have the option of being 'any'.

Br,

Cyrille


------------------------------------------------------------------------------
CenturyLink Cloud: The Leader in Enterprise Cloud Services.
Learn Why More Businesses Are Choosing CenturyLink Cloud For
Critical Workloads, Development Environments & Everything In Between.
Get a Quote or Start a Free Trial Today.
http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
_______________________________________________
Sguil-devel mailing list
Sguil-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/sguil-devel




--
sguil - The Analyst Console for NSM
http://sguil.sf.net