I've been trying to work out a way of doing this, but how does one configure a NAS profile send an Email or SMS on three consecutive events?
I've currently got a logmon profile with a watcher defined to match the expression /java.sql.(\w+)/. A variable (string) has been defined and a threshold has been set (<> SQLException). In addition, I have selected "Send clear alarm" and defined a unique suppression ID ($PROFILE.$WATCHER).
Also, in the AO profile, I have market clear and critical/major/minor so that any clearance it tied to the corresponding alert. I have also defined the number of events to be 3 (and only 3, as I want one Email or SMS to be triggered, not one per new event).
When a SQLException occurs, the logmon probe generates an event, but there are no clearances when the expression is not matched. Also, if there are multiple occurrences of SQLException then the count is increased by the number of occurrences rather than by 1. Even if there are 3 instances of SQLException, I only want it to report 1. It doesn't appear that "Abort on match" will solve this little problem.
Anyway, does anyone have an idea how to address this issue?