On 28/10/2013, Elran Dvir <elrand(a)checkpoint.com> wrote:
Thanks for the valuable feedback!
Regarding remarks about the rule itself:
> a) Each Log without a CorrelatedEvent creates an activation. A
> CorrelatedEvent will not apear until there are 20 Logs with the same
> src/dst combination. This means that there are up to 19 pending
> accumulates until the first
> one reaches the threshold, inserts the CorrelatedEvent and cancels the
> others.
How can I make more efficient?
I think that window:time would be more appropriate. Or implement an
equivalent functionality using an auxiliary container.
> b) Additional inefficiency is produced by the separate accumulation of the
> markers. This set does not participate in LHS constraints, and hence could
> be easily computed on the RHS.
I tried to remove accumulation of the markers.
These are the changes:
New function:
function Set getMarkers(Set matchedLogs) {
HashSet<String> markerSet = new HashSet<String>();
HashSet<String> idSet = new HashSet<String>();
for (Object matchedLogObj : matchedLogs) {
Log matchedLog = (Log) matchedLogObj;
String id = getUniqueId(matchedLog);
if (!idSet.contains(id)) {
idSet.add(id);
markerSet.add(matchedLog.fieldsMap.get("marker").toString());
if (markerSet.size() == 25) break;
}
}
return markerSet;
}
In LHS:
accumulate($accumulatedLog : Log(eval(filter($accumulatedLog)), this
after[0s,60s] $log, fieldsMap.get("src") ==
$log.fieldsMap.get("src"),
fieldsMap.get("dst") == $log.fieldsMap.get("dst"), $id :
getUniqueId(this));
$idSet : collectSet($id) , $matchedLogs:
collectSet($accumulatedLog);
$idSet.size > 19)
In RHS:
fieldsMap.put("cu_markers_list", getMarkers($matchedLogs));
$matchedLogs return as empty set. Why? How can I make it work?
There's no reason why it should be empty if $idSet.size > 0.
-W