RuleBaseEngine:onAlertCount

Method

Purpose

Provides the rulebase engine alert rate statistics every 5 seconds. It provides alert rate averages over the previous 5, 10, 15, 30 and 60 seconds.

Remarks

When using this method as a datasource in a rulebase, the test's clear condition will default to "Clear Timer" with a value of 900 seconds. However, because this async method provides statistics every 5 sec, choosing clear condition "First False" may be more useful.

RuleBaseEngine:onAlertCount and RuleBaseEngine:suspendAllAlerts can be used together to create an alert-rate circuit breaker that insulates the network from agents that produce alerts at message high rates that are too high. For example, using onAlertCount as a data source, if (5sec > 10) then suspendAllAlerts for 60,000 msec. This would suspend all alerts for 1min if the average rate of alerts over the last 5sec was greater than 2 alerts per sec.

 

Type

Asynchronous, IMPACT_INFO

Arguments

None

Returns

 

Name

Type

Description

5sec

Integer

The alert rate averaged over the previous 5 seconds

10sec

Integer

The alert rate averaged over the previous 10 seconds

15sec

Integer

The alert rate averaged over the previous 15 seconds

30sec

Integer

The alert rate averaged over the previous 30 seconds

60sec

Integer

The alert rate averaged over the previous 60 seconds