Recovery expression that depends on an event AND a short time period

[jbcheck]

Hi there,

a windows server often gets an application error on shutdown and I'd like to have an recover expression which depends on a typical event for this behavior WITHIN a short time period.

The problem expression looks like this (COM+ object not found):

logseverity(/test7.testing.de/eventlog[Application,,"Information|Warning|Error|Critical", ,,,skip])=4
and logeventid(/test7.testing.de/eventlog[Application,,"Information|Warning|Error|Critical", ,,,skip],,"^4622$")=1​

The current recovery expression look like this (a service stops on shutdown / reboot and causes the error):

logeventid(/test7.testing.de/eventlog[Application,,"Information|Warning|Error|Critical",,,,skip],,"^17147$")=1

My 'problem': The recovery event is true if it occurs some second after the problem event. The recovery expression should not fire after hours or days.

Is there a possiblity to handle things like I want to?

Thanks a lot!
jbcheck

[jbcheck]

Hallo again,

Unfortunately, I have not found a solution for a time-dependent recovery expression.
I strongly believe in: It still went well. Without a time-dependet recory expression.
As a Cologne dialect: Et hät noch immer jot jejange.

Ciao for now
jbcheck