This could be modelled according to a simple FSM with time supervision.<br>Rather than counting OPEN and CLOSE events, insert a "HasClosed" event,<br>write a rule with a timer monitoring the HasClosed and react to it if it is still<br>
there when the timer expires, retracting the HasClosed; and write another rule<br>matching an(other) OPEN with the HasClosed, which means that the OPEN<br>happens before the timer expires.<br><br>-W<br><br><br><div class="gmail_quote">
On 3 October 2012 20:52, Davide Sottara <span dir="ltr"><<a href="mailto:dsotty@gmail.com" target="_blank">dsotty@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
What you have written counts how many times a connection to the same endpoint<br>
(I'm assuming the connectionInformationId represents the target endpoint, in<br>
some way) has been reopened shortly after being closed. I don't know how<br>
your connection protocols work, but I could see a perfectly legit use case<br>
where your client connects to your server, closes the connection, then "hey<br>
I forgot something" - so it opens (and closes) a new connection. If this<br>
scenario happens more than once in the lifetime of your monitoring system,<br>
the rule fires.<br>
<br>
I'm not sure that this applies to your usecase, but maybe a better way to<br>
model the problem would be something like this?<br>
(please fix the details to match your data structures)<br>
<br>
*Server( $ep : connectionEP )*<br>
accumulate(<br>
$c : ConnectionEvent( type == CLOSE, target == $ep ) *over<br>
window:time(5m)*<br>
and<br>
$o : ConnectionEvent( type == OPEN, target == $ep, this after[0,5s] $c ),<br>
$count : count( $c );<br>
$count > // I'd increase the threshold to 2 or 3... unless you want to<br>
capture glitches in the connection too<br>
)<br>
<br>
In a nutshell, I would scope the pairs to the context of the same endpoint<br>
(especially if you can have different connections in parallel!), and I would<br>
also frame the temporal context within a time window. Is it possible that,<br>
occasionally, your client "forgets" somehting and opens two (succesful)<br>
connections in a row? If this scenario occurred twice in, say, a day, the<br>
rule you proposed would still fire.<br>
<br>
Best<br>
Davide<br>
<br>
<br>
<br>
--<br>
View this message in context: <a href="http://drools.46999.n3.nabble.com/Accumulate-a-on-event-combinations-tp4020104p4020119.html" target="_blank">http://drools.46999.n3.nabble.com/Accumulate-a-on-event-combinations-tp4020104p4020119.html</a><br>
<div class="HOEnZb"><div class="h5">Sent from the Drools: User forum mailing list archive at Nabble.com.<br>
_______________________________________________<br>
rules-users mailing list<br>
<a href="mailto:rules-users@lists.jboss.org">rules-users@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/rules-users" target="_blank">https://lists.jboss.org/mailman/listinfo/rules-users</a><br>
</div></div></blockquote></div><br>