Users Guide

Automation and Event Processing Rules | Alarms, Events, and Automation
304 OMNM 6.5.3 User Guide
Stream Based Correlation has the following rule types:
Frequency Threshold —This rule type changes event behavior based on the frequency of the
selected event. For successive events of the same type, associated with the same entity, it
suppresses or rejects the first few received, up to the given event threshold, within the pattern
expiration time, and publishes the rest.
Enter the
Pattern expiration time (idle time between events), specified in seconds and Event
threshold, number of events required before a notification is published
, then select an Event
Action to take before the threshold is reached
( Reject or Suppress the event). If you Reject an
event, it does not appear in Event history; if you
Suppress it, it creates no alarm, but it does
appear in the Event history. Check
Publish frequency start and stop notifications if you want
OpenManage Network Manager to keep a record of when this rule starts and stops filtering
events.
On receipt of the first event matching the given filter criteria, OpenManage Network
Manager enables the selected pattern. It remains active until no matching events are received
for at least the number of seconds specified as the pattern expiration time. The rule always
waits this number of seconds before publishing the event(s), even if the number of matching
events crosses the threshold before the pattern expires. Every time the rule reaches its
threshold in this time window, it publishes one event and then reset the counter.
For example, consider a pattern configured for 3 events in 10 seconds. If OpenManage
Network Manager receives only 2 matching events in a 10 second time window then it
publishes no events. With these same parameters, if OpenManage Network Manager receives
at least 3 but less than 6 (3 times 2) events, then OpenManage Network Manager publishes
Device Access The Device Access example creates a specific device access event for user login,
logout, login failure or configuration change. Select the Access Type (Config
Change, Login Failure, User Login, User Logout) from the pick list for that
field.
Enter the User Name Variable and/or User Name RegEx match string in those
fields. This confines rule response to the selected users.
Select Suppress Correlated events if you do not want to see events correlated
with this one.
Rule Type Properties