Conway Allen wrote: > Thanks for the reply, Risto. Allow me to make the following remarks: ... > 2. I would argue with the argument about ambiguity because my understanding > of things is/was that when the threshold number of messages didn't arrive > during the time window there would be no event. It seems very strange that > when an event is detected the information you have available refers to a > message that had nothing to do with the event!
well... that's the problem you always have with sliding windows. Unlike with other 9 rule types, the threshold rule could start an event correlation operation which runs longer than the originally specified window. In some cases (when the window has to be moved forward), this causes the event that triggered the counting operation to be outside of the event correlation window. Since currently the substitution values are taken from the first match for all rule types, you are seeing this behavior for threshold rules. I acknowledge that it might not be the best solution if you strictly require $0 to point to a line that starts the event correlation window, and not the line that triggered the operation. Of course, I can look into this issue -- if the change doesn't make the code too complex, it could be done in principle. br, risto ------------------------------------------------------------------------------ Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are powering Web 2.0 with engaging, cross-platform capabilities. Quickly and easily build your RIAs with Flex Builder, the Eclipse(TM)based development software that enables intelligent coding and step-through debugging. Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
