This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Rules and Alerts for Traps with LA

I need to ultimately create an alert from a Trap rule configured in LA. However, I do not want the alert to Trigger until a certain number of the same traps has been received in a set period of time. I know that was an easy thing to do with the Legacy Trap Viewer, but can't seem to see how to do that in LA. Is it done in the Rule or in the Alert? Thanks.

Top Replies

abakus over 1 year ago +2 verified

This option is available in the latest LA (and probably few versions back as well), but it hasn't always been there. Since the rules are triggered in each service separately (trap service, syslog service…

Parents

+1 abakus over 1 year ago

This option is available in the latest LA (and probably few versions back as well), but it hasn't always been there.

Since the rules are triggered in each service separately (trap service, syslog service, etc.), this option is not available either in Global Preprocessing or Global Postprocessing.

So - go to a trap rule and expand Advanced Settings in Rule Conditions - ENRTY COUNT is what you're looking for.
Cancel
Vote Up +2 Vote Down

Cancel
0 borgan over 1 year ago in reply to abakus

Not sure how I missed that. Thanks.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 borgan over 1 year ago in reply to abakus

Not sure how I missed that. Thanks.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data