On 2014-07-08 12:10, aaron.erick...@zootweb.com wrote: > Hi James, > > I would probably approach this using TYPE=SINGLE with a context > specific to the error digits you're interested in, to avoid duplicate > notifications (rather than Singlewiththreshold). > > Something like this. > > type = Single > ptype = RegExp > pattern = Something bad with a number (d+-d+) > context = !bad_event_$1 > desc = Bad Event > action = create bad_event_$1 60; > pipe '%s' /usr/local/bin/sendEmail -f m...@me.com -s server -t > m...@me.com > -u "Bleh" -m "$0" > > Thanks, > > Aaron Erickson > aaron.erick...@zootweb.com > Zoot Enterprises, Inc. www.zootweb.com > 555 Zoot Enterprises Lane, Bozeman, MT 59718 > This email, including any attachments, is confidential and may not > be > redistributed without permission. If you are not an intended > recipient, you have received this message in error. Please notify us > immediately by replying to this message, and then delete it from your > computer. Thank you. > > From: James Lay <j...@slave-tothe-box.net> > To: <simple-evcorr-users@lists.sourceforge.net>, > Date: 07/08/2014 11:06 AM > Subject: [Simple-evcorr-users] A question on SingleWithThreshold > > ------------------------- > > Hey all, > > So I have this type of event: > > Jul 7 19:40:02 Something bad with a number 10333-12344 > Jul 7 19:40:04 Something bad with a number 10333-12344 > Jul 7 19:40:10 Something bad with a number 10333-12344 > > My rule below works just as I want...I only get one alert: > > ype = SingleWithThreshold > ptype = RegExp > pattern = Something bad with a number ([d-]+) > desc = Bad Event > action = pipe '%s' /usr/local/bin/sendEmail -f m...@me.com -s server > -t > > m...@me.com -u "Bleh" -m "$0" > window = 60 > thresh = 1 > > But now say I get this: > > Jul 7 19:40:22 Something bad with a number 10333-12344 > Jul 7 19:40:34 Something bad with a number 10333-12345 > Jul 7 19:40:56 Something bad with a number 10333-12346 > > This are different, so I want to see all three, however the > threshold > > kicks in and I only see the first one. How can I change this > behavior? > I know I'm missing something, but I'm not sure where to look. Thanks > for any assistance you can give. > > James
Thank you much...I will give that a shot. James ------------------------------------------------------------------------------ Open source business process management suite built on Java and Eclipse Turn processes into business applications with Bonita BPM Community Edition Quickly connect people, data, and systems into organized workflows Winner of BOSSIE, CODIE, OW2 and Gartner awards http://p.sf.net/sfu/Bonitasoft _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
