...
- Without
inhibit
, after the first 20 events for group A you'll get one synthetic event for group A; another after the next 20 and so on.
For group B, one synthetic event will be generated for the first 20; the remaining 5 are too few to trigger anything. - With
inhibit
set to 40 seconds (for example), you'll get the very first group A synthetic event as before, but then no synthetic events for this rule and group A for the next 40s;
After that correlation for group A resumes 'from scratch' and any events received from then onwards are counted and correlated as normal.
For group B with its fewer triggers the inhibit behaviour doesn't change anything visibly, there's still just one synthetic event.
Note that the inhibit timer for group A is totally independent of any inhibit for group B: inhibit applies to a particular rule and its fullgroupby
context.
In opEvents version 2.2, the combination of the options autoacknowledge
and inhibit
does not acknowledge trigger events that occur during the inhibit period; only 'successful' triggers are acknowledged. This has been changed for greater consistency and better storm control in versions 2.2.1 and newer, where successful triggers and any trigger events occurring during the inhibit period are also acknowledged automatically.