Rule doesn't fire

[Ilya_Pleskunin1]

Hi everyone!

I have some troubles with creating a rule, which handles events from 2 different systems.

This is the rule Conditions tab:

In my Active channel that I'm using for testing rule there are events from these Connectors, but the rule never fires.

I think that problem is difference between events Manager Receipt Time, but I have no ideas how to solve this problem.

Thanks to everyone for help!

[GCA]

Indeed there is a problem with the manager receipt time.  If your rule is looking to see these 2 events within a minute it will not trigger if the second event is received 35 minutes later even if from a logical point of view the rule is using the endtime to evaluate the conditions.

Why do you get these events so late ?  Maybe can you fix this.  Alternatively you could try to increase the matching time, it should allow the rule to keep the first value in memory for longer but if you try that I suggest you to be very restrictive in your conditions (add more fields like the name) to avoid storing too many partial matches in memory.

HTH

[Ilya_Pleskunin1]

I get the second event later because I get events from this connector scheduled daily, so I think rule have to be scheduled daily, too. In Console User Guide I read that real-time rule won't work in such kind of situation.

Increasing matching time didn't help, but I set Global Expiration Time to 24h, because rule is daily scheduled, and it solved the problem - rule fired in test active channel.

But when I scheduled the rule group where my rule is, it doesn't change anything - I don't see correlation events. I created new active channel with condition [event.Name = "MyRuleName"], but it's empty.  How can I see that the scheduled job run correctly? Can I see correlation events for historical events which were in the past?

I'll be very thankful for help!

[GCA]

you should use generatorId="generator Id value of your rule" as conditions in your active channel to see all events generated by that rule

[Ilya_Pleskunin1]

I've done this, but I see only events "AddToList:Success". These events came when I was verifying my rule with events in Active channel.

So now when I verify rule with events, it fires, but when I make rule scheduled, it doesn't. What can be wrong?

[ArcsightCom]

Type = Base... try it!

[eugene.rostofsk1]

Ilya,

Did you try "Verifying Rule(s) with Events"? You can find more information in the Console User Guide. Unless you can see your rule firing in this test mode exactly when you expect it to fire it will never fire either in real-time or in scheduled modes. PS Make sure the active channel you've selected for testing contains all the necessary base events.

Ihar

[Ilya_Pleskunin1]

Yes, I did. When I verify rule with events, it fires correctly. But when I schedule rule, it doesn't fire at all.