1 Reply Latest reply on Sep 19, 2014 9:56 PM by nicole pauls

    Question on "Correlation Time" in LEM Rules

    familyofcrowes

      I am trying to understand this section better.  I need to send an email for when I have "host flapping" on an interface.  Problem is, I need to alert on the first log (unique to device and port) but not the duplicates that will follow for at least an hour.

       

      How in the world do I set that in the "Correlation Time" section?

       

      I watch many video's but so far none talk about this section, they all say "This is an advanced feature not needed her"...

      Thanks

        • Re: Question on "Correlation Time" in LEM Rules
          nicole pauls

          So, here's the unfortunate deal.... we haven't exposed a way to do a threshold of one, which is what you need.

           

          You CAN do this:

          2 in 10 seconds (alert when you see two of the same event in 10 seconds)

          Advanced Threshold (little gears on the correlation time that become active when you add a threshold):

          SAME <whatever> (interface, source, etc, you can add more than one field)

          Re-Infer: 1 hour

           

          Your Response Window will need to be 1 hour also so it can remember data for that long.

           

          Correlation Time on the entire rule applies to EVERYTHING in the correlations box. You can also add a threshold for each grouping in the correlations box if you want to get more fancy.

           

          Then, the "Advanced Threshold" box basically modifies your threshold by defining how to "count" your threshold (they need to come from the same IP, the same user, etc) and tells the threshold how often to check for "over threshold" again (your "wait an hour before telling me the **** is still hitting the fan" thing).