Hi Risto, Thanks for your answer, you've got the idea.
However, I still have a final doubt. The association among root cause and its son events are both IP and device name. So, the Single rule and the Eventgroup rule type work fine from your example but the second one requires that each event arrives at least once. How would you apply a rule like Eventgroup but without needing all events arrive at least once? I mean, the root cause must trigger the context for the son events (the Single rule) but it's desired that the Eventgroup rule match with one, two or more events. For example, I'll call the root cause as P1 and its son events as S1, S2 and S3, then the idea is to match and report the following occurrences: P1 -> S1 or P1 -> S3 & S2 or P1 -> S2 & S3 & S1 or any other combination Cheers, Gaoke ------------------------------------------------------------------------------ Cloud Computing - Latest Buzzword or a Glimpse of the Future? This paper surveys cloud computing today: What are the benefits? Why are businesses embracing it? What are its payoffs and pitfalls? http://www.accelacomm.com/jaw/sdnl/114/51425149/ _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
