Here is pseudocode of what I'm trying to setup:
If time != weekend:
if event matches in 1 minute:
if event happens >=500 times:
run action 1
else:
run action 2
>From reading the article on sec[1], "SingleWithThreshold" rules can
action when a pattern matches 500 times within 1 minute but _only_
when it happens 500 times. SingleWith2Threshds doesn't look like it
does what I want either. The time != weekend block is not critical,
but would be really nice. It looks like a "Calendar" rule can do that.
My question is basically, "How would I go about setting up sec to
implement something close to the previous pseudocode?". My idea was to
setup 2 rules, 1 being a Single and 1 being a SingleWithThreshold. Is
there a better way to do this? You don't have to handhold me through
creating the config unless you want to.
Thanks for the help
[1] http://sixshooter.v6.thrupoint.net/SEC-examples/article.html
--
Jeff Schroeder
Don't drink and derive, alcohol and analysis don't mix.
http://www.digitalprognosis.com
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
