Events seem to be processed multiple times, instead of just once. For example, events show up twice in emails or are written multiple times to the database. Why?

Filters are processed sequentially, one-by-one, by the EventSentry agent. If an event matches multiple filters, then every filter matching the event will send the event information to the configured target. This usually happens when more than one filter is configured to use "Trigger all actions".

To avoid seeing events multiple times:

• Configure the "Stop processing other filters" option in the filter. No more filters will be processed If an event matches that filter.
• When using multiple include filters, make sure that their filter properties do not overlap.

Note: Starting with EventSentry v2.7x, notifications will never receive the same event more than one time, even if multiple filter rules match the same event.