Hi Dojo,
I had to split my correlation rules. Now I have a correlation rule which is activated when an alarm dropped from critical/major back to normal. But I would like to filter this only when the alarm time was more than 1min.
Is it possible to use the script condition? I have not found that I can access the alarm time.
Using “Presistent event” is not working for “normal” alarms.
Hi Miguel,
in this case we don’t want to touch our alarm templates.
Hi Miguel,
we are testing now the option Collect events for 1minute. Therefore I have merged again the two separated correlation rule. In one rule we have the elements selected and also Major/Critical alarming inside.
I see that this question has been inactive for some time. Have you found a solution for this yet? If yes, could you add an answer with more information for reference for other users?
Hi,
the only solution we have found was the hysteresis. After adjusting it Script was running fine. Checkbox set for Trigger on single events, and immediate evaluation.
Hi Stefan,
Small question, is it not an option to use hysteresis? You could use hysteresis OFF to clear the alarm after 1 minute.