Reducing Number of alerts for event logs

[Sainyam]

hi support,

I am using HM for monitoring events logs.

I am using advanced mode for filtering the events

('%SimpleStatus%'=='DOWN') and ('%Reply%'<>'%LastReply%')

So that I wont get repeated same events logs, but it wont work correctly because of change in time or multiple different events occurs at same time repeated, Yesterday I got around 4k events log alerts emails from one server.

So my question is this possible for make it more advance and it check the event log for last 3-4 events instead only 1.

[KS-Soft]

[KS-Soft Europe]

As I understand, you are using Advanced mode action to filter generated e-mails?
You may try the following expression:
('%SimpleStatus%'=='DOWN') AND ((%Recurrences%==1) OR ('%PrevNTEventID%'<>'%NTEventID%') OR ('%NTEventSource%'<>'%PrevNTEventSource%'))
It should filter similar consecutive events (same Event ID and Event Source)

[Sainyam]

Thanks for the reply,

@KS-Soft Europe
No it wont help,
I am still getting same events repeated it.

I think i should have explain more. I have set alerting only for error events.

Suppose
1. Error Event A occurs at 5:00 AM, I get alert about this.
2. Error Event B occurs at 5:10 AM, I get alert about this.
3. Error Event A occurs again at 5:20 AM, I should not get alert about this, since my team is already start working on it.

That why I want to check not only for previous or last reply but also last 5 replies before generating alerts.

Sometimes it some services create this type of scenario that it generate same set of events let say set 4 different events, which occurs continuously with in a fraction of 1 - 2 seconds, which create alerts 2 - 3k. and my inbox get full.

[KS-Soft Europe]