Using several LA rules in one alert?

veroniks23

Hi!

im using LA Rules to create alerts, I would like to know if I can use several LA Rules in one alert - 

for example I have a rule that checks for the word Down

And another rule that contains the word ‘switchVero’

I’m trying to create alerts by that - but it works only if I use one rule in the trigger condition. 

any ideas?

shuth

I don't think this is possible based on my understanding of how Log Viewer/Analyzer integrates with the alerting engine. 

• When a message comes in and matches the filter, LA triggers an event against that node
• The alert rule is configured to look for this event and if found, triggers an alert against the node (not the message)
• Based on the above, the alert condition in your screenshot will never fire because the rule associated to that single event (in the grey line) cannot have both Processing Rule = A and Processing Rule = B. The event can only have one Processing Rule name.

You might be able to create a complex condition where if you have multiple rules triggered in a short timeframe then trigger, but I can't think of that setup off hand.

It might be easier creating a new LA rule that filters based on "down" and "switchVero" and then have your alert trigger off that new LA rule.