Repetition Rules

Administration > Event Processing > Correlation > Stream-Based Event Correlation

Alternatively, click Stream-Based Event Correlation.

This task shows you how to create a repetition rule.

1. In the Stream-Based Event Correlation Rules pane, click the  New button and select Repetition Rule to open the Create New Repetition Rule dialog box.

2. In the General tab, enter a display name, and (optional) a description of the rule being specified.

3. Select Activate Repetition Rule after creation, if you want to make the rule active immediately.

4. Click Next to open the Conditions page and select an event filter for the rule from the Event Filter list. The filter determines which events to consider for the repetition rule.

   If no appropriate filter is already configured, click the Browse (...) button, which opens the Manage Event Filters side panel. Create a filter or edit an existing one. For information about filters, see Event Filters.

5. Select Hold back events until events fall out of time window, if you want to keep the events selected by the filter from being displayed in the Event Browser during the time period specified by the rule.

6. Add attributes that must be included in events and have matching values for the events to be considered as matching:

   1. Click the New correlation attribute button and select the type of attribute, for example General and select an attribute from the drop-down list.

   2. Repeat for additional attributes.

7. Select the number of identical events that need to be received, and the time period within which they must occur for the rule to be executed. Additionally, select Treat duplicates as repetitions, if you want the number of identical events to include every duplicate as a single event.

8. Set the time window within which these events must occur.

9. Choose whether the actions should be executed the first time (the default) or every time the condition is fulfilled.

   If you choose the default option, a new event is created only the first time the condition is fulfilled (during the initial rule execution) and all subsequent events within the specified time window will correlate to the same cause. They are modified accordingly, which does not apply to the already existing events.

   Decide how you want all subsequent events to be handled, either within the remaining time window (which is set by the initial rule execution), or for the sliding time window, which means that with each subsequent event the time window is automatically extended. The default value is remaining.

10. Click Next to open the Actions page and specify the actions to be executed on the selected events when the rule conditions are met.

    Select the event which will be used as a reference event (that is, the event that will be used for the further processing). It could be the most recent (last) or the least recent (first) event from the initial rule execution. The default is first.

    All events that are identified as recurring events can be handled as follows:

    • Close All Events - Close all events matching this rule.

    • Release Reference Event, Close All Others - Close all events matching the rule except for the reference event, and release the reference event for further processing.

    • Release All Events - Release all events for further processing.

11. Optional. Select Discard, if possible if it is preferred to completely remove the events selected by the rule. This is only possible if the event is still on hold and has not yet been stored in the database.

    Note Whether an event is on hold depends on all SBEC rules that the event matches.

12. Optional. If you want to modify any attributes of selected events before they are sent to the Event Browser, select Edit attributes from the Modify event attributes of non-closed events section, and specify the changes.

13. Select Create a new event, if you want a new event to be automatically generated when the rule conditions are met and specify the attributes of the event by selecting Edit attributes and choosing attributes and entering associated values.

14. If generating a new event, select the Events selected by <filter name> check box if the generated event is to be the cause event for the selected repeated events.

15. If generating a new event as a cause event, specify a Rule Weight for this correlation.

16. Select Finish to save the rule.

• Combination Rules
• Missing Recurrence Rules

The General tab is located in the Create New and Edit Repetition Rule wizards.

User interface elements are described below:

The Condition tab is located in the Create New and Edit Repetition Rule wizards.

User interface elements are described below (unlabeled elements are shown in angle brackets):

UI Element	Description
	New correlation attribute Opens the Attributes menu from which you can specify attributes that must be included in events and have equal values to be considered as matching events. The available attributes are grouped as follows: General Additional Attributes Custom Attributes
	Delete Item Deletes the selected attribute from the attributes list.
Event Filter	The selected filter determines which events to consider for the repetition rule. If no appropriate filter is already configured, click the Browse (...) button, which opens the Manage Event Filters side panel. Create a filter or edit an existing one. For information about filters, see Event Filters.
Hold back events ...	Select Hold back events until events fall out of time window, if you want to keep the events selected by the filter from being displayed in the event browser during the time period specified by the rule.
Correlation	Attributes that must be included in events and have identical values for the events to be considered as matching: Click the New correlation attribute button and select the type of attribute, for example General and select an attribute from the drop-down list. Repeat for additional attributes.
Repetitions	The number of matching events that need to be received for the rule to be executed.
Treat duplicates ...	Select Treat duplicates as repetitions, if you want the number of matching events to include every duplicate as a single event.
Time Window	The time period within which matching events must occur for the rule to be executed. OMi calculates the time period based on the event's creation time.
Execution	Specify when actions should be executed (either the first time or every time the condition is fulfilled) and how to handle subsequent events (remaining or sliding time window).

The Actions tab is located in the Create New and Edit Repetition Rule wizards.

User interface elements are described below:

UI Element	Description
	Modify Events Selected by <filter name>: Specifies how events selected by the rule should be handled: Select first to keep the first event or select last to keep the last event as a reference. Select from the drop-down list: Close All Events - Close all events matching this rule. Release Reference Event, Close All Others - Close all events except for the reference event and release the reference event for further processing. Select first to keep the first event or select last to keep the last event. Release First Event, Close All Others - Close all events except for the least recent event. Release the least recent event for further processing. Release All Events - Release all events for further processing. Discard, if possible completely removes the events selected by the combination rule. This is only possible if the event is still on hold and has not yet been stored in the database. Note Whether an event is on hold depends on all SBEC rules that the event matches.
	Modify event attributes of non-closed events Selected by <filter name>: Select Edit attributes if you want to modify any attributes of selected events before they are released. Edit attributes: Opens the Event Attributes dialog box from which you can specify the attributes and values of events. For details, see Create Event and Modify Event dialog boxes.
	Create a new event: Specifies that a new event is created on matching of the repetition rule. Select Edit attributes to specify the attributes of the automatically-generated event.
The created event is a cause ...	Select the Events selected by <filter name> check box if the generated event is to be the cause event for the selected repeated events.
Rule Weight	Select from a drop-down list a rule weight for this correlation.

The Create Event dialog box is accessed from the Actions tab of the Create New and Edit Repetition Rule wizards. It is used to specify the new event to be generated and sent to the Event Browser or specify the changes to be made to an existing event when the Repetition Rule is matched.

User interface elements are described below: