hi Alexander, you can do it with a combination of singlewiththreshold and pairwithwindow rules. However, here the problem is that rules must check the past for both events A and B. There is no good way for the singlewiththreshold rule to memorize the beginning of counting window - that's because the window can be sliding. If you want to accomplish things in the precise manner, the best way is to manipulate an event queue for both A and B, with another queue containing occurrence times for these events. When either event A or B appears, these two queues must be checked for the events that have occurred during the last 30 seconds. If you spot at least three A's in an event queue with a B occurring after the first A, then you have detected the event you are looking for. You can implement queues as Perl arrays, and use push() from a Perl miniprogram to append to the end of the queues, and shift() for deleting obsolete elements and occurrence times from the beginning of queues. I hope I got your problem description correctly and was able to provide you some ideas how to tackle the problem you have. hth, risto
- > Hi, > I'm new to SEC and I have a question, how to match > the following combined event: > - I have two events, saying event A and event B > - I want to fire an event, if the following two > conditions hold: > - A occurs 3 times during 15 seconds AND > - B occurs within 30 seconds from the beginning of > the 3xA-sequence > > So, the following sequences should be fire an event: > - AAAB (with the 3 A's in 15 seconds and B <= 30 > seconds from the first A) > - ABAA (with the 3 A's in 15 seconds) > - AAAAB (with each of the first 3 and the second 3 > A's in 15 seconds, but B only in the 30 seconds > range from the second A, but not from the first A) > -> so the first A here takes not part in firing the > event > > Typical sequences, which should not fire, are > - no 3 A's in 15 seconds > - B more than 30 seconds after the first A of each > 3xA-sequence > > For the third type of sequences (AAAAB) I think I > need some kind of sliding window, which cannot be > covered by a SingleWithThreshold rule, since the > first 3 A's fire this rule, so the second 3 A's will > not fire anymore. Therefore the sequence is not > recognized... -> False Negative. > > Furthermore I have problems to catch the first and > the second type of sequences (AAAB, ABAA) with one > approach. > > Do you have any ideas, how to model this kind of > event? > Thanks in advance. > > Alexander Claus > > > > > ------------------------------------------------------------------------- > This SF.net email is sponsored by the 2008 > JavaOne(SM) Conference > Register now and save $200. Hurry, offer ends at > 11:59 p.m., > Monday, April 7! Use priority code J8TLD2. > http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ____________________________________________________________________________________ You rock. That's why Blockbuster's offering you one month of Blockbuster Total Access, No Cost. http://tc.deals.yahoo.com/tc/blockbuster/text5.com ------------------------------------------------------------------------- This SF.net email is sponsored by the 2008 JavaOne(SM) Conference Register now and save $200. Hurry, offer ends at 11:59 p.m., Monday, April 7! Use priority code J8TLD2. http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
