I am trying to build at eem trigger that takes two events and only runs the action once if the either one of them is true, but I can't seem to figure out the syntax
my simple script for testing, produces two syslog message if both events are true. I would like it to just run the "action" once for each occurs
no event manager applet check_wireless_stats
event manager applet check_wireless_stats
event tag n1 snmp oid 1.3.6.1.4.1.9.9.661.1.3.4.1.1.1.18 get-type exact entry-op le entry-val 0 poll-interval 30 maxrun 1000
event tag n2 snmp oid 1.3.6.1.4.1.9.9.661.1.3.4.1.1.2.18 get-type exact entry-op le entry-val 0 poll-interval 30
trigger occurs 1
correlate event n1 or event n2
action 002 syslog msg "the event occurred"
I need to be able to run the script once if any of these events occurs or both events occur and not have it trigger the actions twice.
i.e. something like
correlate [event n1 andnot event n2] or [event n2 andnot event n1] or [event n1 and event n2]