In the GFI EventsManager Event Processing Rules you can set a threshold for each rule in order to avoid large quantities of actions and email alerts. There are two modes for the threshold.
In mode one, GFI EventsManager will take no action until 10* of the same events are detected in a 60* second period. After alerting it will wait until another 10* events are seen before taking another action.
In mode two you will get an alert the first time an event is detected. Then no action will be taken until 60* seconds have passed or 100* events are detected.
*These values can be edited in the Threshold tab.
To configure the Threshold on a processing rule, please do the following:
- Open the GFI EventsManager Management Console
- Navigate to the Configuration tab
- Select the desired processing rule and open the Properties
- In the Threshold tab, select the desired threshold and set the number of events and the time for the threshold