My interface state is rule not triggering?
I have setup two rules to update an active list. If the interface is up, it should update the list with UP. If it is down, it should update the list with Down. (I prevent it overwriting with a local variable; time comparison).
Sometimes the rules are not triggering and I have no idea why. Here is an example:
Events from the Interface:
Active List vs. Last State Data monitor. (The monitor is correctly showing down)
Interface UP rule. The Down rule mirrors this. (except for the Name = field).
The down rule does work. I don't know why the ArcSight skips over these events.
Any help is appreciated.