This article provides useful information related to the functionality of the threshold in GFI EventManager Event Processing Rules.
In the GFI EventsManager Event Processing Rules, you can set a threshold for each rule in order to avoid large quantities of actions and email alerts. There are two modes for the threshold:
- Mode 1: The GFI EventsManager will take no action until 10* of the same events are detected in a 60* second period. After alerting, it will wait until another 10* events are seen before taking another action.
- Mode 2: You will get an alert the first time an event is detected. Then, no actions will be taken until 60* seconds have passed or 100* events are detected.
- Open the GFI EventsManager Management Console.
- Navigate to the Configuration tab.
- Select the desired processing rule and open the Properties.
- In the Threshold tab, select the desired threshold. Set the number of events and the time for the threshold.