netiquslaie Absent Member.
Absent Member.
1067 views

Sending an Event Immediately if a Condition is Met

Ok, so I have a bit of code that I dropped into my customPreParse method in custom.js (because I wanted it to take effect before the parse method in the collector):

-------
if (/<regex>/.test(this.s_RXBufferString)) {
e.EventName = "Custom Name";
e.ObserverHostName = this.s_MessageOriginatorHost;
e.Message = this.s_RXBufferString;
instance.SEND_EVENT = true;
return true;
}
--------

The problem I'm running into is that in the release.js, there is code that is basically overwriting my event name and message and submitting the event as an unparsed event. The ObserverHostName gets set properly but nothing else. I thought that "instance.SEND_EVENT = true" would have Sentinel submit the event immediately but apparently not the case.

Is there a way for us to tell the collector when a condition is met, map those values and send the event immediately without trying to do further parsing? Or am I doing something wrong in my snippet here?

Thanks!
0 Likes
6 Replies
Knowledge Partner
Knowledge Partner

Re: Sending an Event Immediately if a Condition is Met

Why not put this in customParse, which I believe comes after parse, so
that he who laughs (or runs) last runs best?

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below...
0 Likes
netiquslaie Absent Member.
Absent Member.

Re: Sending an Event Immediately if a Condition is Met

The reason why is that when the event gets processed by the parse method, the way the collector is currently coded, it causes a parsing error because the parse method is expecting certain values that don't actually exist in this particular message. I have also opened a bug on this issue but I was trying to figure out whether there was a way do deal with this by processing and sending the event in the customPreParse partially as an educational exercise.
0 Likes
Knowledge Partner
Knowledge Partner

Re: Sending an Event Immediately if a Condition is Met

Perhaps you can do both; pre-parse to avoid the error, and post-parse to
fix things up?


--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below...
0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Sending an Event Immediately if a Condition is Met

On 08.02.2017 18:36, netiquslaie wrote:
>
> Ok, so I have a bit of code that I dropped into my customPreParse method
> in custom.js (because I wanted it to take effect before the parse method
> in the collector):
>
> -------
> if (/<regex>/.test(this.s_RXBufferString)) {
> e.EventName = "Custom Name";
> e.ObserverHostName = this.s_MessageOriginatorHost;
> e.Message = this.s_RXBufferString;
> instance.SEND_EVENT = true;
> return true;
> }
> --------
>
> The problem I'm running into is that in the release.js, there is code
> that is basically overwriting my event name and message and submitting
> the event as an unparsed event. The ObserverHostName gets set properly
> but nothing else. I thought that "instance.SEND_EVENT = true" would
> have Sentinel submit the event immediately but apparently not the case.
>
> Is there a way for us to tell the collector when a condition is met, map
> those values and send the event immediately without trying to do further
> parsing? Or am I doing something wrong in my snippet here?


See
https://www.novell.com/developer/plugin-sdk/ref/api/2011.1/symbols/Event.html#send

Something like (not tested)

if (/<regex>/.test(this.s_RXBufferString)) {
e.EventName = "Custom Name";
e.ObserverHostName = this.s_MessageOriginatorHost;
e.Message = this.s_RXBufferString;
e.send();
return false;
}




--
Norbert
0 Likes
netiquslaie Absent Member.
Absent Member.

Re: Sending an Event Immediately if a Condition is Met

That worked, thank you very much for that, Norbert!
0 Likes
brandon-langley Absent Member.
Absent Member.

Re: Sending an Event Immediately if a Condition is Met

netiquslaie;2450646 wrote:
That worked, thank you very much for that, Norbert!


FYI, if you look at the McAfee Email Gateway collector (and I think also the Web Gateway collector) there are a couple different examples of premature sending and re-duplication where appropriate.
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.