Suppression Rules

[Anon Anon]

I'm trying to create some Event Rules around Suppression (Occurrence Count / Repeat Count). My objective is to create a rule that will generate an initial alert, then every 25 alerts after that incase of a flood of alerts come in. I would also like to expire or reset the initial alert because I see this as only occurring 1 time.

Example

I have an alert come in "Test Rule" Event Type 0x350000

Event Type 0x350000 has rule that if 9regexp({v114}{S Test Rule for Event Logs})) evaluates to true, then generate 0x900001

 

Conditions are met, and cause code 0x900001 occurs

Now the Alarm options do not generate a Unique Alarm for Each Event, but I want it to generate a Unique Alarm for every 25 Events.

I'm having trouble figuring out the logic for this. I'm trying to build rules around the repeat count, but I have not yet been successful.

[Anon Anon]

Ok the closest thing I've come to is using the Event Rate Counter, so if an event X occurs 5 times in 60 seconds, it generates event Y. The problem with this approach is if it generates 1 alarm an hour, I want it to create a new alarm each time. How can I get around this.

[Bob_Keville]

Thanks for using the CA Community!  It looks like your question has been answered so we are closing this thread out.  If you have additional questions, please feel free to contact us again.