Hi
I have successfully created 2 rules that mach lines i want to act on but
I'm struggling in finding a way to correlate them.
First description what i want to get
Generate an event for a threshold ie 10 events in 1 hour the problem is
i don't quite get how to count them correctly
First i
hi Przemysław,
for addressing this problem, you could divide it into several independent
subtasks:
1) memorize the mapping from msgid to username, so that each mapping would
exist for a certain amount of time
2) when a bounce event appears in the log, generate a synthetic event for
the bounce, so
