From "up" to "ineof"
In this example, the alert arms when conn_1 transitions from "up" to "ineof."
A state transition that is from any other state in addition to "up" does not arm the alert.
A state transition from "up" to any state in addition to "ineof" does not arm the alert.
If the state stays in "ineof" for 30 seconds, then the alert fires.
- Alert Name: EX10
- Alert Type: protocol status
- Source: conn_1
- State From: up
- Source Count: ineof
- Comparing: diff
- Duration: N seconds and 30
- Action type: notify