Hi folks, unless someone can suggest a way to do this as the software currently stands consider this a feature request.
I'd like the syslog and trap viewers alert functionality to be able to automatically throttle email alerting of repeated events after a certain threshold has been reached.
I realise I can currently set a rule that will act against messages matching a patterns or regex's that will only trigger an action after a certain threshold is reached but I this is not the exact behaviour I require. I want to see all the individual messages until a threshold has been reached and then only receive summaries afterwards i.e.
"message <foo> was received from host <bar> ten times in the last hour."
This leads me onto something else, I would want this logic applying to most but not all messages but syslog and trap viewers' current filtering logic only allows one to explicitly include based on a pattern or regex. I'd like (in this instance and others) to be able to explicitly exclude hosts, message, etc.
