EEM applet: event correlation question

[parisdooz12]

Hi,

I want to develop an applet using correlation of 2 events:

- CPU load behond a threshhold

AND

- specific syslog message received

What I want is to launch actions when the 2 events occur in the same tme.

My doubt is: what happens if the switch detect a CPU load one day, then receive the syslog mesasge another day? Does the appletconsider the event happened, and wait (without limit of time) up to have the 2d event occuring? Or it there a timeout or a way to implement a timeout?

thanks by advance

P.

[Joe Clarke]

You get to specify the time window for the correlation.  Use the command:

trigger period 1

That means both events must occur within the same second for the applet to fire.

[mustafahanci]

Hi..

You can use 2 scripts and 2 snmp RW variables (i.e. description of an unused interface).

First script; to control snmp RW variables AND your events. According to your events you can set variables from 0 to 1.

Second script; to reset variables from 1 to 0 if nothing happens in an limited time.

first script: to set variables according to events (running every 15 seconds)

cpu load variable 0, specific syslog message variable 0 : do nothing

cpu load variable 0, specific syslog message variable 1 : do nothing

cpu load variable 1, specific syslog message variable 0 : do nothing

cpu load variable 1, specific syslog message variable 1 : launch actions

second script:

reset variables in 20 seconds

Mustafa..