ProcessEvent processes the system event against compiled filters. Filter is the internal lingo that designates a rule condition. Filters can be simple direct-event matchers or sequence states that track an ordered series of events over a short period of time.
(evt *event.Event)
| 220 | // Filters can be simple direct-event matchers or sequence states that |
| 221 | // track an ordered series of events over a short period of time. |
| 222 | func (e *Engine) ProcessEvent(evt *event.Event) (bool, error) { |
| 223 | if e.filters.empty() { |
| 224 | return true, nil |
| 225 | } |
| 226 | |
| 227 | if evt.IsTerminateProcess() { |
| 228 | // expire all sequences if the |
| 229 | // process referenced in any |
| 230 | // partials has terminated |
| 231 | for _, seq := range e.sequences { |
| 232 | seq.expire(evt) |
| 233 | } |
| 234 | } |
| 235 | |
| 236 | filters := e.filters.collect(evt) |
| 237 | |
| 238 | var matches bool |
| 239 | for _, f := range filters { |
| 240 | match := f.run(evt) |
| 241 | if !match { |
| 242 | continue |
| 243 | } |
| 244 | if f.isSequence() { |
| 245 | e.appendMatch(f.config, f.ss.events()...) |
| 246 | f.ss.clearLocked() |
| 247 | } else { |
| 248 | e.appendMatch(f.config, evt) |
| 249 | } |
| 250 | err := e.processActions() |
| 251 | if err != nil { |
| 252 | log.Errorf("unable to execute rule action: %v", err) |
| 253 | } |
| 254 | switch { |
| 255 | case e.config.Filters.MatchAll: |
| 256 | matches = true |
| 257 | default: |
| 258 | return true, nil |
| 259 | } |
| 260 | } |
| 261 | |
| 262 | return matches, nil |
| 263 | } |
| 264 | |
| 265 | // processActions executes rule actions |
| 266 | // on behalf of rule matches. Actions are |