Hi Risto thanks for your fast response. the synthetic calendar heartbeat worked fine - limited to one occurence in a period.
The textual description of your second solution was not clear to me. I tried type=SingleWithThreshold ptype=RegExp pattern=MYEVENT desc=OK received action=event SUFFICIENT_NO_OF_MYEVENTS action2=event SUFFICIENT_NO_OF_MYEVENTS window=60 thresh=3 type=PairWithWindow ptype=SubStr pattern=SUFFICIENT_NO_OF_MYEVENTS desc=NOK received action=write - %s ptype2=SubStr pattern2=MYEVENT desc2=OK received action2=write - %s window=60 But it didn't work out. If I send 3 MYEVENT patterns within 60 s, the event is fired: Creating event 'SUFFICIENT_NO_OF_MYEVENTS' Creating event 'SUFFICIENT_NO_OF_MYEVENTS' Afterwards nothing happens anymore. I tried continue=TakeNext, but without success. Regards Sven 2010/4/30, Risto Vaarandi <[email protected]>: > Sven, > > if you would like to verify that a certain event appears once in N > seconds, and generate an alert if the event is NOT there, you could use > the following solution (the ruleset is just a rough example, but > hopefully it conveys the idea): > > type=Calendar > time=* * * * * > desc=heartbeat check > action=event HEARTBEAT_CHECK > > type=PairWithWindow > ptype=SubStr > pattern=HEARTBEAT_CHECK > desc=No heartbeat has been observed > action=write - %s > ptype2=SubStr > pattern2=MYEVENT > desc2=heartbeat OK > action2=none > window=120 > > The first rule generates the HEARTBEAT_CHECK synthetic event once in 60 > seconds. This event is matched by the second rule which starts an event > correlation operation that waits for the event MYEVENT. If MYEVENT will > not arrive within 120 seconds, the operation writes an alert message "No > heartbeat has been observed" to standard output. > > If you would like to check if MYEVENT is present at least N times in a > time window T, you could implement a SingleWithThreshold operation for > that which generates the synthetic event SUFFICIENT_NUMBER_OF_MYEVENTS, > if MYEVENT has been observed for N times in window T. This event could > then be matched by the PairWithWindow rule as described above. > However, in that case some subtleties remain -- the counting window for > SingleWithThreshold is sliding; also, the action is executed when > threshold N is reached, *not* at the end of the counting window. > Fortunately, SingleWithThreshold rule has an optional 'action2' > parameter which suits exactly for the taking an action when the counting > window ends. > > Hope that this helps, > risto > > On 04/30/2010 01:48 PM, Sven Leupold wrote: >> Hi >> >> I wonder how I could implement a rule that triggers an action if a >> pattern did not appear OR less than MIN times for a time period n. >> >> Thanks a lot in advance >> >> Sven >> >> ------------------------------------------------------------------------------ >> _______________________________________________ >> Simple-evcorr-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users >> > > > ------------------------------------------------------------------------------ > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
