On Tue, Mar 11, 2008 at 12:48 AM, <[EMAIL PROTECTED]> wrote: > > Hi Jeff, > > what you would do is setting up a context the first time your event matches, > with a lifetime of 1 min. At the end of the context, you run action 2. Then > you use a SingleWithThreshold rule walid only if your context exists. If it > checks, you run action 1 and delete the context. > > About the not weekend, yes, it's a calendar rule. Let's see: > > # Calendar to disable on weekends (created on sat 00:01, lasts 48 h) > type=Calendar > time=1 0 * * 6 > desc=Weekend context > action=create Weekend 172800 > > #Context to start matching. When it ends, runs action 2 and resets the count > rule. > type=Single > ptype=RegExp > pattern=<whatever> > continue=takenext > context=!Weekend&&!1_min_count > desc=Begin 1 min count for 500 errors > action=Create 1_min_count 60 (<run action 2>; reset Correlate_500_events) > > #Event count. We correlate 500 events while 1_min_count still exists, and > delete the context if limit met > type=SingleWithThreshold > ptype=RegExp > pattern=<whatever> > context=!Weekend&&1_min_count > desc=Correlate_500_events > action=<run action 2>; \ > delete 1_min_count > window=<more than 60 sec, but whatever, since the correlation is reset by > 1_min_count expiration> > thresh=500 > > It's not tested, but I believe it would work as you intend. Notice the ! in > the second rule context (you only want to create the context once)
Wow that worked perfectly. Thankyou Josep! -- Jeff Schroeder Don't drink and derive, alcohol and analysis don't mix. http://www.digitalprognosis.com
foo.log
Description: Binary data
------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
