[Contents] [Prev] [Next] [Index] [Report an Error]

Dampening an Event

Sometimes events are generated repeatedly within a short period of time. In this case, it is redundant to execute a policy multiple times, once for each instance of the event. Event dampening allows you to slow down the execution of policies by ignoring instances of an event that occur within a specified time after another instance of the same event.

In the following example, an action is taken only if the eventd process has not received another instance of the event within the past 60 seconds. If an instance of the event has been received within the last 5 seconds, the policy is not executed and a system log message for the event is not created again.



event-options {
    policy dampen-policy {
        events event1;
        within 60 events event1;
        then {
            ignore;
        }
    }
    policy policy {
        events event1;
        then {
            ...
        }
    }
}

[Contents] [Prev] [Next] [Index] [Report an Error]