ELK zone violated

[zra]

ive been having this problem for a while and i decided its time to address it.

I have events that are triggered when a zone is violated. The event, among other things, sends me an email indicating what occured. the problem ive been having is that i get multiple emails. so, obviously the event is triggering over and over. i installed a timer to prevent that, and it helped(i was getting 10 to 15 emails before) as i only get about 4 or so. Im guessing that the event triggers so fast that before the timer doesnt equal zero its triggered 4 times.

for the event filter im using IS ZONE VIOLATED

any idea what i can do to prevent successive triggers?

[Dean Roddey]

Go to the start menu and open the CQC Command Prompt. Run the program CQCEventDump. It will just do a raw dump of events.

Then go violate a zone and see how many events are getting spit out in your case. In theory they should only happen when the state actually changes, though there are some issues in the Elk wrt to not being able to completely enforce that as I remember, though not sure if it's related to the zone violation stuff I'd have to go back and look.

But just see how many you are getting, and make sure that they really are effectively the same events, for the same zone with the same state.

[Dean Roddey]

From a quick look it looks like they should only be sent if the actual zone status changes. However, they are sent out for more than violated state. They are sent out for secure, bypassed, and violated. So perhaps you might be getting some of those other states as well? If so you could filter on a specific state if that's what it turns out to be.

[zra]

I am filtering for the violated only. after looking at the dump im only seeing 1 event when i, say, open a window.

so, i ran a test and put a variable in the action that increments to see how many times it's executing:

after opening the window for about 3 seconds and then closing i checked the counter. its over 1000 now and its continuing to increment. hmm. thoughts?

[Dean Roddey]

And you still only saw one event trigger show up for that? Or, presumably two, one when it was violated and one when it went back normal?

[Dean Roddey]

And is this a triggered event in the server, or some background event running in a user interface? How are you viewing the value of the variable?

[zra]

Ive now rebooted the server and the incrementer continues.

[zra]

Originally Posted by Dean Roddey

And is this a triggered event in the server, or some background event running in a user interface? How are you viewing the value of the variable?

Yes, a triggered event.

i increment the GVar and then write it to a field variable.

[zra]

Originally Posted by Dean Roddey

And you still only saw one event trigger show up for that? Or, presumably two, one when it was violated and one when it went back normal?

yes, the CQCeventdump shows only one execution for violated. nothing for the other states.

[Dean Roddey]

Can you try, just for funzies, triggering that same event in some other way, such as setting it up to trigger on some variable driver field write and change the field via the var driver interface, and see what happens?

Oh, and BTW, when you say it's still incrementing, you mean you see the field that you are writing to continuing to increment continuously? If you delete the triggered event does it stop?