Highlighted
Absent Member.
Absent Member.
686 views

Is it possible to have a rule wait?

Let's say we have two differents received by ESM in the following order:

Event 1

Event 2

We need to fire on event 1 if we do not see event 2 within the next minute or so. Is there are way to accomplish this? Thank you for your thoughts

0 Likes
Reply
16 Replies
Highlighted
Absent Member.
Absent Member.

Hi Rob, yes it can trigger the event however the correlated event does not have the base event included.

0 Likes
Reply
Highlighted
Respected Contributor.
Respected Contributor.

Hello Jianjun,

That is indeed the drawback of that option. Most likely you need to create a procedure for your analysts on how to find the base event that triggert the rule initially. I have hit that wall as well and I have not found a way to go around this. To be honest I find it a bug as with the other options it is adding the base event to the correlated event.

Regards,

Richard

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Hi Richard, thank you for sharing your experience with us.

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

Have you try sending the base event to an activelist and then use the GetActiveList function to get the value back when the alert fires.

0 Likes
Reply
Highlighted
Absent Member.
Absent Member.

I believe this because you need "Cumulative Rule Chain" set to "On".

If you click on and activate the "On Time Window Expiration [Active]" in your actions tab, it should show the Cumulative Rule Chain option.

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.