我只想写入文件 case 行,并且所有实例都$
以 nvp_add 函数中的符号开头,然后从输入文件下方声明扩展属性,因此我希望在我的文本输出文件中得到如下所示的输出。
case "11": ### eventDDoSLow
$severity
$description
$eventID
$eventURL
$alertLevel
$eventStart
$eventSourceCount
$eventSourceTable
$eventDestCount
$eventDestTable
$eventProtocolCount
$eventProtocolTable
输入文件如下:
case "11": ### eventDDoSLow
include "$NC_RULES_HOME/include-snmptrap/riverbed/riverbed-
MAZU-MIB.parser.include.snmptrap.rules"
@URL = $eventURL
$OS_EventId = "SNMPTRAP-riverbed-MAZU-MIB-eventDDoSLow"
@AlertGroup = "Denial Of Service"
@AlertKey = "Event ID: " + $eventID
@Summary = "Denial of Service ( Src: " + $mazuSourceName + ", Dest: " +
$mazuDestName + " )" + " ( " + @AlertKey + " ) "
$DEFAULT_Severity = 2
$DEFAULT_Type = 1
$DEFAULT_ExpireTime = 0
@Identifier = @Node + " " + @AlertKey + " " + @AlertGroup + " " +
$DEFAULT_Type + " " + @Agent + " " + @Manager + " " + $specific-trap
$alertLevel = $alertLevel + " ( " + $5 + " )"
if(match($OPTION_EnableDetails, "1") or
match($OPTION_EnableDetails_riverbed, "1")) {
details($severity, $description, $eventID, $eventURL, $alertLevel,
$eventStart, $eventSourceCount, $eventSourceTable, $eventDestCount, $eventDestTable,
$eventProtocolCount, $eventProtocolTable)
}
@ExtendedAttr = nvp_add(@ExtendedAttr, "severity", $severity,
"description", $description, "eventID", $eventID,
"eventURL", $eventURL, "alertLevel", $alertLevel,
"eventStart", $eventStart,
"eventSourceCount", $eventSourceCount, "eventSourceTable",
$eventSourceTable, "eventDestCount", $eventDestCount,
"eventDestTable", $eventDestTable)