Is there a way to accomplish this without using the NAS? On the second occurrence in a 5min interval, if it matches a string, then alarm. If only one occurrence per interval, no alarm. Then. If over 3 matches, stop for that given interval. The second part should be accomplished by the max alarm count. Could the multiple match just be two separate watcher rules looking for the same thing?
Just using NAS you can accomplish this specific Rules.
Can I ask the purpose of this specific behavior with the alarm?
apparently the customer doesn't want to know about it unless it writes to the log several times in a interval. I really didn't want to use the NAS to perform this function.