3 Replies Latest reply on Jul 29, 2013 4:32 AM by ian.brown

    Can not get any rules to fire in LEM - What am I doing wrong?

    ian.brown

      Well as the title says I'm not having much luck with getting any rules working in the LEM console. I have tried making some rules using the LEM video guides and Im pretty confident that I have created them correctly. Failing that I tried using some of the templates provided incase it was my fault such as the notification when USB defender service is disabled which will send an email alert. I used this template and added my account to recieve the emails and ensure that the Activate rules button has been clicked. Once i disable the service nothing happens, the service stopping is picked up in the Ndepth monitor but the rule is not firing to notify me.

       

      Here is the rule used for the USB Defender Service stopping

      USB_Service_rule.PNG

      I have the email settings correctly configured as any test emails are sent to my address so I'm really at my wits end on why it won't work. Infact non of the rules from any of the templates even show up as being fired in OPS Center dashboard.

       

      Please note that we are currently on an evaluation of this software so it did cross my mind that it may be this thats stopping the rules but it seems silly that these would be disabled.

        • Re: Can not get any rules to fire in LEM - What am I doing wrong?
          HMote

          Try setting your 'Response Window' to 30 seconds and click Save instead of Apply and then Save (more on that below).  I just had my correlation time at the same settings as you and it wouldn't work.  I changed that and it started working as intended.

           

          I've recently upgraded to 5.6 and it looks like when you click Apply, the Correlation Time does not save, if you've updated these.  I did find that just clicking Save instead of Apply and then Save, made the change stick.  I don't know if that is just an issue with mine or just an issue in general.

           

          I've tried to find some good documentation on the Correlation Time, but have yet to find any that clearly defines what the fields mean and what are acceptable values in these fields.  I hope this helps!

          1 of 1 people found this helpful
          • Re: Can not get any rules to fire in LEM - What am I doing wrong?
            ian.brown

            Okay so a few more things didn't seem right with the console this morning with a few of the widgets stating they had no data and showing sample data instead. So I decided to reboot the Virtual server and now hey presto my rules are firing correclty and the USB defender software is working as it should.