We have a requirement to write some writes into a file and we are currently doing through NAS AO. We are not using the alert for anything other than writing into a file. So planning to put a pre-processing script to write the events into file and exclude the event in the end of the script. Please let me know your suggestions and would be happy if there is a script available
Scripting is not my thing (so why respond ) however it seems to me there is an assumption that this is the only or best way to fulfill the need. It will be really helpful to provide quality advice if there is a full understanding of what's going on.
what type of file is it?
what needs to be written into the file?
what triggers the need to write to the file?
where is the file located?
what/who reads the file?
why/what is the need to read the file?
For the most part you should be able to take the script from your AO and use that.
Instead of an alarm structure, the preprocessing script will already have a variable named "event" that contains the message.
There are restrictions on the functions you can use in a preprocessing script but the file IO calls appear to be allowed.
At the end of the script return nil and the event will be discarded.
Only one preprocessing script will match an event - so if you have multiple scripts care needs to be taken that there's no overlap in the matching criteria or you need to duplicate script content.
Preprocessing fires on every message so if you're capturing something like a CDM message that is sent every interval, you'll fire the preprocessing script on every message - as opposed to an AO profile where you might be using count or overdue age to limit executions.
And as an aside, you'll get much better answers if you include detail about what you are trying to achieve and work you've already done. There may well be a much better approach to your final goal than this preprocessing idea but without knowledge of that goal, it's hard to say. Answering why you are required to write some data to a file might result in a better answer.