Can I use a variable across events?

Question

Hi there,
SDK newbe! I'm successfully parsing an GroupWise WebAccess event log.
At the beginning of each days log is a line with the server name and IP
address. Subsequent events only have the date/time and event message.
How can I capture the name and IP of the sever and then use it for
SourceIP and SourceHostName for all the other subsequent events?
if (this.s_RXBufferString.search(/^.*?IP Address: (\w+) \((.+)\)/) !=
-1) {
/^.*?IP Address: (\w+) \((.+)\)/.exec(this.s_RXBufferString);
var InitSrvr = RegExp.$1;
var InitSrvrIP = RegExp.$2;
this.evt = "Test_IP_Variable";
this.bm = this.s_RXBufferString;
this.sip = InitSrvrIP; //This does work
this.shn = InitSrvr; //This does work
this.sun = ("KirkWasHere " + InitSrvr);
instance.SEND_EVENT = true;
return true;
// give the following a try. $1-$3 are mm-dd-yy, $4-$6 are hh-mm-ss,
else if (this.s_RXBufferString.search(/(\d{2})-(\d{2})-(\d{2})
(\d{2})\d{2})\d{2}) (Login failed): (\S+)/) != -1) {
/(\d{2})-(\d{2})-(\d{2}) (\d{2})\d{2})\d{2}) (Login failed):
(\S+)/.exec(this.s_RXBufferString);
this.evt = RegExp.$7;
this.sun = RegExp.$8;
this.sip = InitSrvrIP; //This does not work?
this.shn = InitSrvr; //This does not work?
this.bm = this.s_RXBufferString;
this.sev = "3";
instance.SEND_EVENT = true;
return true;
kmaule
kmaule's Profile: https://forums.netiq.com/member.php?userid=306
View this thread: https://forums.netiq.com/showthread.php?t=46902

Answer 1

kmaule,
First, ARGH! Why can't systems create audit data? Or if just logging
data, why can't they do something sensible like have a date in there like
everything else? *sigh*
Okay, I feel better now. I have not tried either of the following ideas,
but I want to share them so you can figure them out and hopefully post
back their feasibility. I'm hoping to have time to test this next week,
but who knows with how things have been lately... busy busy. Here are the
two ideas:
1. Collector development has the idea of a 'Session' object which is made
to span across two events. This is useful when you need to link two
original events to create one Sentinel events, such as with OES and
filesystem auditing; in that case the OES system sends three lines per
filesystem event and Sentinel must group them to create one Sentinel
event. Similarly, eDirectory object-create events are actually two events
(object create without object class, and add-value with the object class)
that become one in Sentinel (eDir auditing is just THAT lost-level...
crazy) and also LDAP events from eDir consist of the LDAP Request event
and the LDAP Response event. Session objects make this possible, but they
are meant to exist for a short period of time (I think usually one second
or so, though they have a customizable timeout as I recall) and are meant
to be created and then used when other conditions are satisfied. My hope
is hat you can abuse this functionality to store a variable between events
and then nuke the old session object when a new date comes through. More
on sessions:
http://www.novell.com/developer/plug..._sessions.html As I
read more about this I think it's not going to be as possible as I
thought. Hmmmm
2. Set a variable on the collector object somehow, and I mean in-memory,
not in the hard-coded plugin or something. I need to get the debugger
going to see how this could work, but the problem with your local
variables is that they're local variables, so they do not persist when the
current variable scope (the current function/method) returns to whatever
called it, so the next time something calls it then they are brand new
again. The logic needs to set these variables somewhere that will persist
(Session or collector object instance level) so that it can be retrieved
from there for each subsequent event.
Other dirty things I would not recommend, but which may work. I believe
you can get at dynamic list data in collectors. You could potentially
store the date there when it comes in and then retrieve it on subsequent
events.
Other dirty things... use the current date for everything. Pulling this
up in code should be trivial, but it implies that events come in on the
current date. That's probably a safe assumption 99.99% of the time, but
some events may come in wrong at the start of a new day, though you could
add logic to help with that too.
Ideally GW needs better logs, and more than that it needs a true auditing
interface of some kind.
Good luck.
On 02/21/2013 08:54 AM, kmaule wrote:
>
> Hi there,
>
> SDK newbe! I'm successfully parsing an GroupWise WebAccess event log.
> At the beginning of each days log is a line with the server name and IP
> address. Subsequent events only have the date/time and event message.
> How can I capture the name and IP of the sever and then use it for
> SourceIP and SourceHostName for all the other subsequent events?
>
> if (this.s_RXBufferString.search(/^.*?IP Address: (\w+) \((.+)\)/) !=
> -1) {
> /^.*?IP Address: (\w+) \((.+)\)/.exec(this.s_RXBufferString);
> var InitSrvr = RegExp.$1;
> var InitSrvrIP = RegExp.$2;
> this.evt = "Test_IP_Variable";
> this.bm = this.s_RXBufferString;
> this.sip = InitSrvrIP; //This does work
> this.shn = InitSrvr; //This does work
> this.sun = ("KirkWasHere " + InitSrvr);
> instance.SEND_EVENT = true;
> return true;
> }
>
> // give the following a try. $1-$3 are mm-dd-yy, $4-$6 are hh-mm-ss,
> else if (this.s_RXBufferString.search(/(\d{2})-(\d{2})-(\d{2})
> (\d{2})\d{2})\d{2}) (Login failed): (\S+)/) != -1) {
> /(\d{2})-(\d{2})-(\d{2}) (\d{2})\d{2})\d{2}) (Login failed):
> (\S+)/.exec(this.s_RXBufferString);
> this.evt = RegExp.$7;
> this.sun = RegExp.$8;
> this.sip = InitSrvrIP; //This does not work?
> this.shn = InitSrvr; //This does not work?
> this.bm = this.s_RXBufferString;
> this.sev = "3";
> instance.SEND_EVENT = true;
> return true;
>
>