From: Robert Klemme <shortcutter@...>
Date: 2009-02-04T18:05:58+09:00
Subject: Re: Hash counting

2009/2/3 Jesús Gabriel y Galán <jgabrielygalan@gmail.com>:
> On Tue, Feb 3, 2009 at 11:12 PM, Stuart Clarke
> <stuart.clarke1986@gmail.com> wrote:
>> Thanks for your response. It makes a lot more sense and you are on the
>> right lines I think. There is other code around this but it does not
>> bare much relevance:
>>
>> def scanEVTWithSource(file, source)
>> @alerts = []
>> @evtLogArray = []
>
> This is unneeded, since you later assign another array to this
> variable without using this one.

Also, when reinitializing these variables on each method call then
chances are that they can be local variables and not instance
variables - unless, of course, some other method in the class (which
class?) uses the leftovers of scanEVTWithSource in those instance
variables.

I am suspecting the issue is somewhere above the method. For example,
you might have a loop calling scanEVTWithSource and expecting that
counts are aggregated throughout all calls but they aren't since you
reinitialize the Hash on each call.

>>    begin
>>    #read the contents of the event logs files
>>    evtLog = EventLog.open_backup(file, source)
>>
>>    #put data into an array
>>    @evtLogArray = evtLog.read.sort { |a, b| (a.event_id <=>
>> b.event_id).nonzero? || (a.time_written <=> b.time_written)}
>
> Are you sure you want to put this in an instance variable?
>
>>    #event log data collected
>>    evtLog.close
>>    if evtLogArray.length == 0
>
> Shouldn't this be checking the @evtLogArray?
>
>>      return
>>    end
>>
>>    #failed logons where more than 10 have occurred in a day
>>    if event.event_id == 529
>
> Here we are reaching the culprit, I think. What is event? It's not
> defined in this method...
>
>>      eventdateID = []
>>      #assign all time written values to the eventsbydate array
>>      eventsbydate = "#{event.time_written}"
>>      eventdateID.push eventsbydate.gsub(/\s/, '')[0..7] +
>> eventsbydate[26..30]
>>      counts = Hash.new(0)
>>      eventdateID.each {|d| counts[d] += 1}
>>      counts.each do |id,cnt|
>>        @alerts.push("#{event.event_id} #{@tab} #{event.time_written}
>> #{@tab} #{event.event_type} #{@tab} #{type}") if cnt >= 5
>>      end
>>    end
>> end
>>

Absolutely agree to your other comments.  I still think we haven't
seen all the code. Also, the whole problem is not very clear to me
either.

Cheers

robert

-- 
remember.guy do |as, often| as.you_can - without end