Navigation:  Working with EventSentry > Actions >

Action Thresholds

Top  Previous  Next

You can limit the number of events that are passed on to an action using filter thresholds, which works well in most scenarios and offers a lot of advanced configuration settings for threshold settings (e.g. event log logging etc.).

 

However, in some cases it might be more desirable to apply a limit to an action instead of, or in addition to, setting thresholds on filters. This is useful when you have a large amount of filters sending events to an action (and it would be time-consuming to setup thresholds on all of them), or if you have an action (e.g. a pager) where you want to absolutely make sure that only a limited number of events are forwarded to the action.

 

By setting limits on actions, you can ensure that the action will at most be triggered the set amount of times in the configured time period, regardless of how many events are being passed to the action by one or more filters.

 

clip0063

 

It is important to understand that an action limit does not apply to the number of events, but instead to the number of times the action is triggered. For example, if you set a limit to an Email action, then the limit will apply to the number of emails, not the number of events inside the emails.

 

As such, the action limit feature works differently depending on the type of action that is being triggered. Please see the list below for more details on how the action limit works for different action types:

 

Action Type

Per Event

Per Trigger (Detail)

Email (SMTP)

-

Yes (per email)

Pager (SNPP)

-

Yes (per connection to SNPP server)

Database

-

Yes (per connection to database server)

Syslog

-

Yes (per connections to Syslog server)

File

Yes

-

Parallel

Yes

-

Network Message

Yes

-

Process

Yes

-

Sound

Yes

-

Desktop

Yes

-

Jabber

Yes

-

SNMP

Yes

-

Service

Yes

-

Shutdown

Yes

-

 

 

Alert or Warning 1 24 n g

Example: If you set an action limit to a maximum of 5 in 5 minutes, then you will get a maximum of 5 emails - even though the email might contain any number of events.

 

The same settings would limit the number of events delivered through instant messages to 5 however, since the "Jabber" action type has the limit applied to the number of events.