Changeset 358

Timestamp:

Sep 20, 2011, 6:54:19 PM (13 years ago)

Author:

katerina

Message:

Patch for ticket #264 (Add a deadtime for correlate rules to avoid multiple reports).

Location:

trunk

Files:

• include/sh_log_correlate.h (modified) (1 diff)
• src/sh_log_check.c (modified) (1 diff)
• src/sh_log_correlate.c (modified) (2 diffs)

trunk/include/sh_log_correlate.h

@@ -22 +22 @@
 void sh_keep_match();
 
+/* Deadtime for a correlation rule
+ */
+int sh_keep_deadtime (const char * str);
+
 #endif

trunk/src/sh_log_check.c

@@ -1315 +1315 @@
         N_("logmonburstcron"),
         sh_repeat_set_cron,
+    },
+    {
+        N_("logmondeadtime"),
+        sh_keep_deadtime,
     },
     {

trunk/src/sh_log_correlate.c

@@ -180 +180 @@
 
 struct sh_mkeep * mkeep_list = NULL;
-
+unsigned long     mkeep_deadtime = 60;
+
+int sh_keep_deadtime (const char * str)
+{
+  unsigned long  value;
+  char * foo;
+
+  value = (size_t) strtoul(str, &foo, 0);
+
+  if (*foo == '\0') {
+    mkeep_deadtime = value;
+    return 0;
+  }
+  return -1;
+}
 
 int sh_keep_match_add(const char * str, const char * queue, 
@@ -304 +318 @@
 
                   if ((mkeep->reported < now) &&
-                      (60 < (now - mkeep->reported)))
+                      (mkeep_deadtime < (unsigned int)(now - mkeep->reported)))
                     {
                       mkeep->reported = now;