Hi, I'm new to SEC and I have a question, how to match the following combined event: - I have two events, saying event A and event B - I want to fire an event, if the following two conditions hold: - A occurs 3 times during 15 seconds AND - B occurs within 30 seconds from the beginning of the 3xA-sequence
So, the following sequences should be fire an event: - AAAB (with the 3 A's in 15 seconds and B <= 30 seconds from the first A) - ABAA (with the 3 A's in 15 seconds) - AAAAB (with each of the first 3 and the second 3 A's in 15 seconds, but B only in the 30 seconds range from the second A, but not from the first A) -> so the first A here takes not part in firing the event Typical sequences, which should not fire, are - no 3 A's in 15 seconds - B more than 30 seconds after the first A of each 3xA-sequence For the third type of sequences (AAAAB) I think I need some kind of sliding window, which cannot be covered by a SingleWithThreshold rule, since the first 3 A's fire this rule, so the second 3 A's will not fire anymore. Therefore the sequence is not recognized... -> False Negative. Furthermore I have problems to catch the first and the second type of sequences (AAAB, ABAA) with one approach. Do you have any ideas, how to model this kind of event? Thanks in advance. Alexander Claus ------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Register now and save $200. Hurry, offer ends at 11:59 p.m., Monday, April 7! Use priority code J8TLD2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
