[rules-users] Accumulate a on event combinations

[Wolfgang Laun]

This could be modelled according to a simple FSM with time supervision.
Rather than counting OPEN and CLOSE events, insert a "HasClosed" event,
write a rule with a timer monitoring the HasClosed and react to it if it is
still
there when the timer expires, retracting the HasClosed; and write another
rule
matching an(other) OPEN with the HasClosed, which means that the OPEN
happens before the timer expires.

-W


On 3 October 2012 20:52, Davide Sottara <dsotty at gmail.com> wrote:

> What you have written counts how many times a connection to the same
> endpoint
> (I'm assuming the connectionInformationId represents the target endpoint,
> in
> some way) has been reopened shortly after being closed. I don't know how
> your connection protocols work, but I could see a perfectly legit use case
> where your client connects to your server, closes the connection, then "hey
> I forgot something" - so it opens (and closes) a new connection. If this
> scenario happens more than once in the lifetime of your monitoring system,
> the rule fires.
>
> I'm not sure that this applies to your usecase, but maybe a better way to
> model the problem would be something like this?
> (please fix the details to match your data structures)
>
> *Server( $ep : connectionEP )*
> accumulate(
>   $c : ConnectionEvent( type == CLOSE, target == $ep ) *over
> window:time(5m)*
>   and
>   $o : ConnectionEvent( type == OPEN, target == $ep, this after[0,5s] $c ),
>   $count : count( $c );
>   $count > // I'd increase the threshold to 2 or 3... unless you want to
> capture glitches in the connection too
> )
>
> In a nutshell, I would scope the pairs to the context of the same endpoint
> (especially if you can have different connections in parallel!), and I
> would
> also frame the temporal context within a time window. Is it possible that,
> occasionally, your client "forgets" somehting and opens two (succesful)
> connections in a row? If this scenario occurred twice in, say, a day, the
> rule you proposed would still fire.
>
> Best
> Davide
>
>
>
> --
> View this message in context:
> http://drools.46999.n3.nabble.com/Accumulate-a-on-event-combinations-tp4020104p4020119.html
> Sent from the Drools: User forum mailing list archive at Nabble.com.
> _______________________________________________
> rules-users mailing list
> rules-users at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/rules-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/rules-users/attachments/20121003/c4cb8ff0/attachment.html