> IIRC once the SingleWithThreshold rule is triggered all the > events it > is counting are cleared, but I am not sure about that. I > think it > works like this: > time event action > (min) > 0 message > 10 message > 20 message > 30 message > 40 message create > saw_5_events > 50 message > (ignored) > 60 message > (ignored, window expires) > 70 message > 80 message > 90 message > 100 message > 110 > message create > saw_5_events > > but it's possible this could be valid: > > time event action > (min) > 0 message > 10 message > 20 message > 30 message > 40 message create > saw_5_events > 50 message > (ignored) > 60 message > (ignored, window expires) > 70 message create > saw_5_events (time=10,20,30,40,70) > 80 message create > saw_5_events (time=20,30,40,70,80) > 90 message create > saw_5_events (time=30,40,70,80,90) > 100 message > create saw_5_events (time=40,70,80,90,100) > 110 message > create saw_5_events (time=70,80,90,100,110) > > I'd have to test as the manual doesn't say what happens to > the sliding > window if the rule is triggered. But in the first case, the > calendar > rule should work fine as the 3601 second lifetime permits > the > saw_5_events to be seen by the calendar rule even if it was > created > just at the beginning of the hour period.
In order to clarify -- the window is sliding as long as the threshold has not been reached. Once the counter equals to the threshold, the following matching events are ignored for the remainder of the time window. When the window ends, the correlation operation simply terminates without any attempt to continue the counting process. kind regards, risto > > Hopefully that gives you some more ideas about how to > approach the > monitoring problem. > > -- > > -- rouilj > John Rouillard > =========================================================================== > My employers don't acknowledge my existence much less my > opinions. > > > ------------------------------------------------------------------------------ > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
