[rules-users] Accumulate a on event combinations

[gboro54]

Thanks. I believe you are correct(my threshold is small this is just for some
testing purposes.) I like the idea you have come up with.

Thanks!


Davide Sottara wrote
> What you have written counts how many times a connection to the same
> endpoint (I'm assuming the connectionInformationId represents the target
> endpoint, in some way) has been reopened shortly after being closed. I
> don't know how your connection protocols work, but I could see a perfectly
> legit use case
> where your client connects to your server, closes the connection, then
> "hey I forgot something" - so it opens (and closes) a new connection. If
> this scenario happens more than once in the lifetime of your monitoring
> system, the rule fires.
> 
> I'm not sure that this applies to your usecase, but maybe a better way to
> model the problem would be something like this?
> (please fix the details to match your data structures)
*
> Server( $ep : connectionEP )
*
> accumulate(
>   $c : ConnectionEvent( type == CLOSE, target == $ep ) 
*
> over window:time(5m)
*
>   and 
>   $o : ConnectionEvent( type == OPEN, target == $ep, this after[0,5s] $c
> ),
>   $count : count( $c );
>   $count > // I'd increase the threshold to 2 or 3... unless you want to
> capture glitches in the connection too
> )
> 
> In a nutshell, I would scope the pairs to the context of the same endpoint
> (especially if you can have different connections in parallel!), and I
> would also frame the temporal context within a time window. Is it possible
> that, occasionally, your client "forgets" somehting and opens two
> (succesful) connections in a row? If this scenario occurred twice in, say,
> a day, the rule you proposed would still fire. 
> 
> Best
> Davide





--
View this message in context: http://drools.46999.n3.nabble.com/Accumulate-a-on-event-combinations-tp4020104p4020120.html
Sent from the Drools: User forum mailing list archive at Nabble.com.