Changeset 260 for trunk/include


Ignore:
Timestamp:
Dec 7, 2009, 10:00:29 PM (15 years ago)
Author:
katerina
Message:

Support event correlation (ticket #178).

Location:
trunk/include
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/include/sh_cat.h

    r192 r260  
    167167 MSG_LOGMON_REP,
    168168 MSG_LOGMON_SUM,
     169 MSG_LOGMON_COR,
    169170#endif
    170171

  • trunk/include/sh_log_evalrule.h

    r183 r260  
    3535int sh_eval_gend (const char * str);
    3636
     37/* Process a single log record
     38 */
    3739int sh_eval_process_msg(struct sh_logrecord * record);
     40
     41/* Match correlated rules
     42 */
     43void sh_keep_match();
     44
    3845#endif

  • trunk/include/sh_string.h

    r215 r260  
    8484char ** split_array_list(char *line, unsigned int * nfields, size_t * lengths);
    8585
     86/* Return a split_array_list() of a list contained in 'PREFIX\s*( list ).*'
     87 */
     88char ** split_array_braced (char *line, const char * prefix,
     89                            unsigned int * nfields, size_t * lengths);
     90
    8691/* Replaces fields in s with 'replacement'. Fields are given
    8792 * in the ordered array ovector, comprising ovecnum pairs
Note: See TracChangeset for help on using the changeset viewer.