--- On Fri, 4/30/10, Sven Leupold <sleup...@leo.li> wrote:
> From: Sven Leupold <sleup...@leo.li> > Subject: Re: [Simple-evcorr-users] How To Implement Minimum Thresholds? > To: simple-evcorr-users@lists.sourceforge.net > Date: Friday, April 30, 2010, 5:56 PM > Hi Risto > > thanks for your fast response. the synthetic calendar > heartbeat worked > fine - limited to one occurence in a period. > > The textual description of your second solution was not > clear to me. I tried > > type=SingleWithThreshold > ptype=RegExp > pattern=MYEVENT > desc=OK received > action=event SUFFICIENT_NO_OF_MYEVENTS > action2=event SUFFICIENT_NO_OF_MYEVENTS > window=60 > thresh=3 > > type=PairWithWindow > ptype=SubStr > pattern=SUFFICIENT_NO_OF_MYEVENTS > desc=NOK received > action=write - %s > ptype2=SubStr > pattern2=MYEVENT > desc2=OK received > action2=write - %s > window=60 > > But it didn't work out. If I send 3 MYEVENT patterns within > 60 s, the > event is fired: > > Creating event 'SUFFICIENT_NO_OF_MYEVENTS' > Creating event 'SUFFICIENT_NO_OF_MYEVENTS' > > Afterwards nothing happens anymore. I tried > continue=TakeNext, but > without success. I actually meant to set up three rules in the following manner: type=Calendar time=* * * * * desc=heartbeat check action=event HEARTBEAT_CHECK type=SingleWithThreshold ptype=RegExp pattern=^MYEVENT$ desc=OK received action=event SUFFICIENT_NO_OF_MYEVENTS action2=event SUFFICIENT_NO_OF_MYEVENTS window=60 thresh=3 type=PairWithWindow ptype=SubStr pattern=HEARTBEAT_CHECK desc=NOK received action=write - %s ptype2=SubStr pattern2=SUFFICIENT_NO_OF_MYEVENTS desc2=OK received action2=write - %s window=60 In other words, the first rule generates HEARTBEAT_CHECK events that inititate the check, while the second rule creates SUFFICIENT_NO_OF_MYEVENTS events that end the check. Is the overall idea clearer now? Note that it is only one way for addressing the problem - there might be other ones which suit better to your needs. regards, risto > > Regards > > Sven > > 2010/4/30, Risto Vaarandi <risto.vaara...@seb.ee>: > > Sven, > > > > if you would like to verify that a certain event > appears once in N > > seconds, and generate an alert if the event is NOT > there, you could use > > the following solution (the ruleset is just a rough > example, but > > hopefully it conveys the idea): > > > > type=Calendar > > time=* * * * * > > desc=heartbeat check > > action=event HEARTBEAT_CHECK > > > > type=PairWithWindow > > ptype=SubStr > > pattern=HEARTBEAT_CHECK > > desc=No heartbeat has been observed > > action=write - %s > > ptype2=SubStr > > pattern2=MYEVENT > > desc2=heartbeat OK > > action2=none > > window=120 > > > > The first rule generates the HEARTBEAT_CHECK synthetic > event once in 60 > > seconds. This event is matched by the second rule > which starts an event > > correlation operation that waits for the event > MYEVENT. If MYEVENT will > > not arrive within 120 seconds, the operation writes an > alert message "No > > heartbeat has been observed" to standard output. > > > > If you would like to check if MYEVENT is present at > least N times in a > > time window T, you could implement a > SingleWithThreshold operation for > > that which generates the synthetic event > SUFFICIENT_NUMBER_OF_MYEVENTS, > > if MYEVENT has been observed for N times in window T. > This event could > > then be matched by the PairWithWindow rule as > described above. > > However, in that case some subtleties remain -- the > counting window for > > SingleWithThreshold is sliding; also, the action is > executed when > > threshold N is reached, *not* at the end of the > counting window. > > Fortunately, SingleWithThreshold rule has an optional > 'action2' > > parameter which suits exactly for the taking an action > when the counting > > window ends. > > > > Hope that this helps, > > risto > > > > On 04/30/2010 01:48 PM, Sven Leupold wrote: > >> Hi > >> > >> I wonder how I could implement a rule that > triggers an action if a > >> pattern did not appear OR less than MIN times for > a time period n. > >> > >> Thanks a lot in advance > >> > >> Sven > >> > >> > ------------------------------------------------------------------------------ > >> _______________________________________________ > >> Simple-evcorr-users mailing list > >> Simple-evcorr-users@lists.sourceforge.net > >> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > >> > > > > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > > Simple-evcorr-users mailing list > > Simple-evcorr-users@lists.sourceforge.net > > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > > > > ------------------------------------------------------------------------------ > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
