ESM Rule multiple firing

So I have a weird problem.

I have a standard rule that correlates 3 different events. It generally works fine, however for some events it starts firing multiple (2-4) times without a reason. 

I have checked and each rule event correlates same base events (same eventIDs, same endTime, etc). Each rule event has same time, same aggregation fields, and differ only in eventId

The rule is configured to run Set Event Field Action on every event and has matching time and aggregation time set for 30 secs. 

Does anyone now a way to troubleshoot this behavior. 

Parents
  • If you are using join condition on the rule, check "consume after match" option.

  • I indeed have a join condition.  Should I enable it for all the Event Definitions or only one?

    I would still be interested to see which log can show me why the rule is fired multiple times even though base events are not repeated. 

    So to say for each 2 event definitions there is a single base event that fits the conditions. Rule fires and matches 2 events in the first, then proceeds and fires again and matches same events again in another rule event. What is weird that it does not happen every time, but randomly.

Reply
  • I indeed have a join condition.  Should I enable it for all the Event Definitions or only one?

    I would still be interested to see which log can show me why the rule is fired multiple times even though base events are not repeated. 

    So to say for each 2 event definitions there is a single base event that fits the conditions. Rule fires and matches 2 events in the first, then proceeds and fires again and matches same events again in another rule event. What is weird that it does not happen every time, but randomly.

Children