Ok, just to let you know that something is actually going on
We've just written the overview of how this will work. We will create a config during the day. But maybe the overview is already interesting, so here it is:
####
This is more or less a general description of how the rule set works.
The events are tracked by status variables. They are named "Occured<EventID>" where <EventID> is the ID of the event we are looking at (e.g. 6006). These variables are either set to 0 (event did not yet occur) or 1 (event occured). The variables are reset (0) each day at around midnight (time window A). Then, they are set (1) if the specific event occurs within the time frame where it must occur (time window B). Even a bit later, we check if the variable is set. And if it is NOT, we can initiate notification action (time window C).
The tricky part is to look at the events at specific time periods. We do this with the help of a heartbeat service. That service is configured to run sufficiently often (15 minutes in our case), so that we will have at least one heartbeat during each time frame. Please note that the heartbeat event itself will simply be ignored - it is just used to keep the process running.
For obvious reasons, we also need an Event Log monitor.
Time windows A) and C) are bound to the heartbeat service. Time window B) needs to be bound to the event log monitor. Please note that this can also be done in an already existing rule set for an event log monitor. The time windows must be specified in filter conditions.
####
Rainer
Back to your phpLogCon instance
I have received a message "One of the events is missing"
