Conference azur::mcc

    you need to be a bit clearer about what you are asking. (questions
    use down and up to mean from NONE to ANYTHING, and from ANYTHING
    to NONE)
    
    1) do you want only the last alarm to show on the map, so that
    	if it goes down and then comes up you only see the up?
    
    2) do you want the down to cause the up rule to start, and when
    	the up fires the down rule starts running?

I have two rules as follows:

circuit_down = (change_of(node4 mynode circuit syn-0, substate, none,*))
circuit_up = (change_of(node4 mynode circuit syn-0, substate, *,none))

Rule CIRCUIT_DOWN will fire when circuit SYN-0 changes from NONE to either
STARTING or SYNCHRONIZING, indicating the circuit is down.  On the other hand,
CIRCUIT_UP will fire when the circuit SYN-0 changes back from STARTING or
SYNCHRONIZING, to NONE, indicating that the circuit is back up.

What I want is for the map to reflect the latest rule that has fired, so that if
the circuit goes down and then back up again, I only see the up.  (as you said)

Thanks,

George

    Okay you can do it, but you have to think through just want you
    want to do so that you don't lose anything else in the process.
    
    The Notify command allows you to explicitly associate any number
    of events with each other (as you are interested in) by simply
    requesting them explicitly on the notify command.  Such as:
    
    	NOTIFY DOMAIN xxx ENT LIST=(domain xxx rule 1, domain xxx rule
    	2), EVENTS=(OSI RULE FIRED) ! or any other combinations of events
    
    But, and this is the big one to note, that if you ask for these
    events through this notify command AND still have a notify command
    set up for any notification events (default in the map is to do
    this on every domain opened) then you are going to get the events
    twice, once for each notify, and only one set will be correlated.
    To get around this you would want to NOT use the default notify
    command and instead have two commands one for these two rules 
    and another that lists  the rest (not great...).
    

    Ah, that's the part I wasn't grasping.  I probably read over this note
    in the documentation and didn't fully understand it.  Thanks for the
    clarification.
    
    This is exactly what I was looking for and will fall directly in line
    with how I use notifications.  I make an explicit notification request
    in each domain to receive notification events.  Then I rely on the
    notify request that MCC automaticaly creates for me to receive the alam
    events.  Now, all I have to do is disable the automatic notify request
    and make specific notify requests on the alarms.
    
    
    Thanks again,
    
    George

    glad it helped.
    

    I thought I'd come back and let you know how things went with the alarm
    correlation.
    
    I tried the suggestion in .3, but I'm afraid it didn't work. 
    Notification Services will correlate two events from the same source
    for one target entity.  But two events, from two different sources for
    one target entity will not correlate.
    
    This is something for the wishlist.  In the meantime, any other ideas?
    
    Thanks in advance,
    
    George