Re: Decisions in Different Ruleset Threa
1998-07-15 10:06:35
Use /usr/OV/bin/nvrsEdit command to create a ruleset, or edit an existing
ruleset. Use the "save as" command to save the rule you are working on as
"nvcdebug.rs". Then create a dynamic workspace and choose the
"nvcdebug.rs" as the correlation rule to be tested. As long as the dynamic
workspace is active tracing for the nvcdebug.rs will take place in
/usr/OV/log/nvcorrd.alog or blog. Once you close the dynamic
workspace tracing will stop. If you can generate events to match your rule
nodes the trace data will become more interesting.
Regards,
Phil Moore
|
|
|