Hey all, So I have this type of event:
Jul 7 19:40:02 Something bad with a number 10333-12344 Jul 7 19:40:04 Something bad with a number 10333-12344 Jul 7 19:40:10 Something bad with a number 10333-12344 My rule below works just as I want...I only get one alert: ype = SingleWithThreshold ptype = RegExp pattern = Something bad with a number ([\d-]+) desc = Bad Event action = pipe '%s' /usr/local/bin/sendEmail -f m...@me.com -s server -t m...@me.com -u "Bleh" -m "$0" window = 60 thresh = 1 But now say I get this: Jul 7 19:40:22 Something bad with a number 10333-12344 Jul 7 19:40:34 Something bad with a number 10333-12345 Jul 7 19:40:56 Something bad with a number 10333-12346 This are different, so I want to see all three, however the threshold kicks in and I only see the first one. How can I change this behavior? I know I'm missing something, but I'm not sure where to look. Thanks for any assistance you can give. James ------------------------------------------------------------------------------ Open source business process management suite built on Java and Eclipse Turn processes into business applications with Bonita BPM Community Edition Quickly connect people, data, and systems into organized workflows Winner of BOSSIE, CODIE, OW2 and Gartner awards http://p.sf.net/sfu/Bonitasoft _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
