eventCountThreshold element

The <eventCountThreshold> element is valid only for the threshold rule. It defines the number of events that must meet the event selection criteria in a certain time period. The <eventCountThreshold> element also specifies one of two possible time interval modes, either fixed or sliding, for the time window.

Details

fixed interval
A fixed interval begins when the first event that meets the event selection criteria is received and ends when one of the following occurs:
  • The rule meets its threshold within the specified time duration.
  • The specified time duration has passed.
sliding interval
A sliding interval begins when the first event that meets the event selection criteria is received. However, when the rule has not met its threshold and the specified time duration has passed, the time window adjusts (slides) the beginning time to the event reception time for a new "first" event, which is typically the next event that is accepted. The sliding interval continues to adjust in this way until one of the following occurs:
  • The rule meets its threshold within the specified time duration.
  • After the event that begins the time window is received, no subsequent events are received within the specified time duration.
The event that begins the time window (becomes the new "first" event) is the event with a reception time that meets this criteria: the reception time, added to the time interval duration for the rule, is greater than the current time. Here is the criteria in the form of an equation:
event reception time + time interval duration for rule > current time
When no such event exists, the sliding interval cannot adjust the time any further, and the interval ends.
The threshold rule counts each accepted event until either the threshold is met or the time period ends. Then it runs the actions that are defined within the <onDetection> element or the <onTimeOut> element, as appropriate.
<onDetection> actions
These actions run when the event count equals the value that is defined by the threshold attribute of the <eventCountThreshold> element, which indicates that the threshold is met.
<onTimeOut> actions
When these actions run is dependent on whether the time interval mode is fixed or sliding.
fixed mode
With fixed mode, these actions run when the time window expires.
sliding mode
With sliding mode, these actions run if, after the event that begins the time window is received, no subsequent events are received within the specified time duration. In other words, no event is received with a reception time that, when added to the time interval duration for the rule, is greater than the current time.

The time interval mode for the time window is defined by the timeIntervalMode attribute of the <eventCountThreshold> element. The following scenario illustrates the behavior of, and differences between, the two possible time interval modes.

Scenario that illustrates fixed and sliding modes

Assume that the rule receives four events that meet the event selection criteria, one event at each of these times: 8:00, 8:04, 8:06, and 8:07. The event count threshold is 3, and the duration for the time window is 5 minutes.
Rule behavior with fixed mode
With this time interval mode, the threshold rule begins processing at 8:00, and it runs the <onTimeOut> actions at 8:05 because it receives only 2 events in 5 minutes. Therefore, it does not meet its threshold within the time window. When the third event is received at 8:06, the threshold rule begins processing again, and it runs the <onTimeOut> actions at 8:11 because it receives only 2 events in 5 minutes.

The fixed mode is static.

Rule behavior with sliding mode
With this time interval mode, the threshold rule begins processing at 8:00. At 8:05, when the time window is scheduled to complete, the rule determines that it has received only 2 events. The rule then discards the event that it received at 8:00 and recalculates the duration to end at 8:09 (since the first event is now the one that it received at 8:04). When the rule receives the event at 8:07, it runs the <onDetection> actions because it has now met its threshold (3 events, at 8:04, 8:06, and 8:07) within the latest time window (8:04 – 8:09).

The sliding mode is dynamic in that it continues to adjust (to slide) the beginning time in an attempt to meet its threshold within the time window.

Now assume that the rule receives 4 events that meet the event selection criteria, one event at each of these times: 8:00, 8:04, 8:06, and 8:10. The event count threshold is 3, and the duration for the time window is 5 minutes.
Rule behavior with sliding mode
In this case, the threshold rule begins processing at 8:00. At 8:05, when the time window is scheduled to complete, the rule determines that it has received only 2 events. The rule then discards the event that it received at 8:00 and recalculates the duration to end at 8:09 (since the first event is now the one that it received at 8:04).

At 8:09, when the time window is now scheduled to complete, the rule determines that it has received only 2 events. The rule then discards the event that it received at 8:04 and recalculates the duration to end at 8:11 (since the first event is now the one that it received at 8:06).

At 8:11, when the time window is now scheduled to complete, the rule determines that it has received only 2 events. The rule then discards the event that it received at 8:06 and recalculates the duration to end at 8:15 (since the first event is now the one that it received at 8:10).

At 8:15, when the time window is now scheduled to complete, the rule determines that it has received no events since the event at 8:10 that began the time window. The rule then runs the <onTimeOut> actions.

Attributes

<eventCountThreshold> has the following attributes:

Table 1. Attributes of the <eventCountThreshold> element
Name Description Data type Required?
threshold Defines the number of events that must meet the event selection criteria within a certain time period. This is the event count threshold that is to be met. This value must be a positive integer. xsd:positiveInteger Yes
timeIntervalMode Defines whether the time interval for the time window is fixed or sliding. The valid values for this attribute are:
  • fixed (the default value)
  • sliding
xsd:string No

Contained within

<eventCountThreshold> is contained within the following element:

Contains

<eventCountThreshold> contains no elements.