Patrick -
I am not certain that I understand what your second case is for, and Steve
Francis has given you a suggestion which may work, in any case, but I thought I
would comment on your questions.
You guessed correctly about how the Reset-on-Match and Pass-on-Match functions
work with incoming events. I tried to clarify that in my second append last
week. Only events of the type connected to Slot 1 are held in cache. The
Slot 2 event is used to evaluate the events in the cache as soon as it is
received. The Slot 2 events are not cached at all, and once used, they are
discarded unless you added additional processing for them, which is why your
ruleset doesn't handle your second case. If no matches are received during the
time interval, the cache is flushed, and the appropriate action taken for the
Slot 1 event -- for Reset, it is passed along to the next ruleset node, for
Pass, it is dropped.
James Shanks
Tivoli (NetView for UNIX) L3 Support
|