Is this beyond the scope of logmon? Seems really simple, somehow when the count = 30 then send alarm. Does it have to be an AO rule? Can someone talk me through this?
Maybe
Minimum Match Count: Define the minimum number of times the Threshold breach for all defined variables must occur for the probe to generate the alarm.
logmon IM Configuration - CA Unified Infrastructure Management Probes - CA Technologies Documentation
Yup, that did it. I was on CAT mode and it was greyed out. I couldn't figure out why I couldn't try that section out for a while until I noticed the documentation hinted at the fact it doesn't work in CAT mode.
Thanks