

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
HelloExperts,
I installed a factstore file on OMW server and using it from couple of months. one of the correlation rule uses a perl function which i have copied in %ovinstalldir%contrib\ecs\external\perl\XXXXX.pl and loaded using -load_perl function and this rule works fine.
today i created another rule which uses new perl function so i copied this perl file to same location and tried to load this perl function as well. Here the problem begins.
loading new perl function will remove the previous one and if i dont load i am getting below error.
Type mismatch while creating/altering the event. : Attribute = SEVERITY. Value = []
So what can i do to load both the function in Correlation Engine?
Any help in this regard will be appriciated.
Thank You.
-KAKA-
Accepted Solutions

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Hello.
Why not put both functions in the same file? Or if you want it in different files, this is described in the "Correlation Composer User's Guide", chapter "Support for Multiple Perl Files".
Regards,
Goran

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Hello.
Why not put both functions in the same file? Or if you want it in different files, this is described in the "Correlation Composer User's Guide", chapter "Support for Multiple Perl Files".
Regards,
Goran


- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Re: using more than one perl function in Correlation Composer
putting both the function in one file solved the problem. regrading the chapter you mentioned i did not get much out of it. is there a simple example to have a better understanding?
-KAKA-

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Re: using more than one perl function in Correlation Composer
That chapter has a simple example:
In file p.pm you have:
sub f {
my $rv = "HELLO THERE!!";
return $rv;
}
1;
And in t.pl you have:
BEGIN{
push(@INC, '\/opt\/OV\/contrib\/ecs\/external\/perl\/');
}
use p;
Or for Windows, t.pl would have:
BEGIN{
push(@INC, $ENV{OvInstallDir} .'contrib\\ecs\\external\\perl\\');
};
use p;
You would then specify "t.pl" in Composer.
The next chapter also includes some helpful notes:
When creating multiple Perl files, it is recommended that you create one main
Perl file that contains a BEGIN block that performs a few initialization tasks,
at most. Make sure to include all the other Perl files in the main Perl file by
adding a use keyword.
For example, two users create individual Perl files. The first user develops a
set of Perl functions in user1.pm. The second user develops a set of Perl
functions in user2.pm. You can include both files in the main Perl file,
main.ovpl, by using the statements use user1; and use user2;. Only the
main.ovpl file must be referenced from Composer.
In this example, if the files user1.pm and user2.pm are in a different location
than the main.ovpl file, the file main.ovpl must add their locations:
push(@INC, <location of Perl files>);
If user1.pm and user2.pm have clashing function names, the main.ovpl file
must use the scope resolution operator (::) when making a function call like
user1::f().
All Perl files other than the main Perl file must have the extension .pm.
Hope this helps.
Regards,
Goran