I wish to have a trigger that sends an email when a particular eventid is written to the eventlog on our blackberry enterprise server. This works great with the following trigger expression and resets after 5 minutes.
{CES_BES:eventlog[Application].logeventid(20154)}=1 & {CES_BES:eventlog[Application].nodata(300)}#1
However, when there is an issue with bes a seperate event with this id is written for each bes user, therefore we get a lot of alerts where one would be suffice.
I'd like to have it so that it only sends an alert if the last trigger value was 0, ie it wasn't set to get around this but have not been successful so far with the following expression
{CES_BES:eventlog[Application].logeventid(20154)}=1 & {CES_BES:eventlog[Application].nodata(300)}#1 & {TRIGGER.VALUE}=0
The icing on the cake would be to get an alert which would be able to inform how many instances of the eventid occured over a time period (say 5/10 mins)
Thanks in advance for any help!
{CES_BES:eventlog[Application].logeventid(20154)}=1 & {CES_BES:eventlog[Application].nodata(300)}#1
However, when there is an issue with bes a seperate event with this id is written for each bes user, therefore we get a lot of alerts where one would be suffice.
I'd like to have it so that it only sends an alert if the last trigger value was 0, ie it wasn't set to get around this but have not been successful so far with the following expression
{CES_BES:eventlog[Application].logeventid(20154)}=1 & {CES_BES:eventlog[Application].nodata(300)}#1 & {TRIGGER.VALUE}=0
The icing on the cake would be to get an alert which would be able to inform how many instances of the eventid occured over a time period (say 5/10 mins)
Thanks in advance for any help!