hi Natalia,
Hello
>
>
>
> I'd like to ask you about the memory behaviour of sliding windows. Let's
> say we have a rule "single with threshold" with a time interval of 30
> minutes which must match 30 occurrences of a certain event during that time
> window. If the figure of 30 events is not reached, I understand that the
> window "slides" adding a time interval equal to the time that has passed by
> between the first and the second event.
>
>
>
> - When does this process end if the rule never fires?
>
This process will end when no events are left in the window after sliding.
However, if this will never happen (say, your example rule sees events
after each 15 minutes), the event correlation operation will exist forever.
Nevertheless, the SingleWithThreshold rule can be easily rewritten as
EventGroup rule which supports the 'init' and 'end' parameters. These
parameters allow for executing actions when the operation starts and ends.
For example, you can set a termination context for 10 minutes with
'init=create TIMER 600 (reset 0)'
which terminates the given operation after 600 seconds. Also, you can
remove the self-destruction context with 'end=delete TIMER' when the
operation terminates normally.
- When sliding occurs, is a new window opened in memory or the previous one
> is re-used ? (so this is not adding any memory usage I guess)
>
sliding simply means updating the existing data record in memory, and
recording the new beginning of the window into it.
> - Are there any other side effects of this behaviour? (cpu-wise,
> memory-wise, ..)
>
There are no side-effects. By default, the housekeeping of data structures
and checks for expired windows, contexts and other entities are done after
each 1 second. If you would like to change this default and do it less
often, you can use the --cleantime command line option for setting a larger
housekeeping interval. However, this will make event correlation process
less precise, since the expiration of entities is no longer discovered with
a precision of one second.
kind regards,
risto
>
>
> Thanks!
>
> Natalia
>
>
> ------------------------------------------------------------------------------
> The best possible search technologies are now affordable for all companies.
> Download your FREE open source Enterprise Search Engine today!
> Our experts will assist you in its installation for $59/mo, no commitment.
> Test it for FREE on our Cloud platform anytime!
>
> http://pubads.g.doubleclick.net/gampad/clk?id=145328191&iu=/4140/ostg.clktrk
> _______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
>
------------------------------------------------------------------------------
The best possible search technologies are now affordable for all companies.
Download your FREE open source Enterprise Search Engine today!
Our experts will assist you in its installation for $59/mo, no commitment.
Test it for FREE on our Cloud platform anytime!
http://pubads.g.doubleclick.net/gampad/clk?id=145328191&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
