Dear community,
I have created a correlation rule that combines a 'filter condition' and a 'script condition'.
The rule has the 'Auto Clear' flag set as well.
However the correlation does not clear the event when the script condition no longer applies.
Is there any way to make the correlation act on change of the script parameter ?
Thanks in advance for your insights.
Hi Hans,
I did a quick test and having a 'script condition' alone or combined with a 'filter condition' appear to be working and clearing correctly.
Could you give us some details as to what kind of 'script conditions' you are using?
Conditions are only evaluated when the correlation engine is triggered by alarm events, so if you are using something like:
count(*) > 5
it will automatically clear the alarm because it only changes when alarm events happen.
For other options (e.g., property(view.location)), you need to ensure that the property is configured to update the alarms on value change.
Hi Hans,
For the parameter value itself, I am not aware of a way of achieving what you are after.
The only workaround I can think of is to also include that parameter in an alarm that the correlation rule processes, or to have the change of value trigger a property change (or similar that would cause an alarm to be updated).
Thanks for your quick feedback.
My script condition is a parameter check: parameter(1201,566,1) == n
So not clear to me how to assure a trigger on this.