EMS Manual

Filter Tables and Burst Filters
EMS Manual—426909-005
6-9
Burst Filters
Burst Filter Directives
Defined in terms of the filter directives used to configure a burst filter, an event burst is
the occurrence of N or more similar events during T1 seconds. An event burst is
considered to have ended when the bursting event does not occur for T2 seconds. The
values of the N, T1, and T2 parameters are supplied by the user.
In addition to the N, T1, and T2 parameters, other burst configuration parameters
include:

Maximum number of bursting events that can be monitored simultaneously (S)

Length of the subject token value used in event comparison (L)

Time between periodic checks for burst end conditions (T3)
The timer starts when the first burst is detected and is cancelled when there are no
more bursts. If the subject length parameter (L) is set to zero, the subject token ID is
still compared, but the value is disregarded in the comparison for an event match. The
token ID is also disregarded if L is set to -1.
Determining an acceptable value for the S parameter might require careful fine-tuning.
The greater the value of S, the larger the number of simultaneous event bursts that can
be detected. However, a high S value increases filter processing time and table size.
All directives must be preceded by a question mark (?).
Note. Other table keywords (except ?COMMENT) and filter table entries cannot appear
together with these burst filter directives. Only one burst filter can be loaded into a collector or
distributor. However, other filter tables and compiled filters can be added. The order of
execution is the same as the order in which the filters are added.