Re: [rules-users] CEP Rule Help Needed

Hi Edson, Thanks for the fix, but the problem still happens :( Here my complete .drl file: package Correlator global com.s2grupo.triton.global.Context Context declare Snort @role( event ) icmp_code: String tcp_sport: String data: String sig_rev: String tcp_dport: String udp_sport: String hostname: String interface: String sig_priority: String icmp_type: String id: java.lang.Long sig_class_name: String ip_dst: String sig_name: String udp_dport: String ip_src: String event_date: java.util.Date end rule "SnortRule" salience 2 dialect "mvel" when $s1 : Snort( sig_name != "(portscan) Open Port") from entry-point "Correlator" $s2 : Snort( sig_name != "(portscan) Open Port" , id != $s1.id, ip_dst == $s1.ip_dst, this after [5m] $s1) from entry-point "Correlator" then System.out.println("****************** Snort Alert!!!!" + $s1.getData()); retract($s1); end rule "SnortRuleRetract" salience 1 dialect "mvel" when $s1 : Snort( sig_name != "(portscan) Open Port") from entry-point "Correlator" $s2 : Snort ( sig_name != "(portscan) Open Port" , id != $s1.id, this after [0m,5m] $s1) from entry-point "Correlator" then retract($s2); System.out.println(" ********* Deleting Fact From WM"); end rule "SnortRule0" salience 0 dialect "mvel" when $s1 : Snort( this.sig_name != "(portscan) Open Port") from entry-point "Correlator" then System.out.println("********* Snort Alert 0!!" + $s1.getData()); end As you can see, I'm trying to correlate snort events with drools. With this scenario, the only rule that is firing is "SnortRule0" 2009/7/21 Edson Tirelli <tirelli(a)post.com&gt;