rafale.cfg

<setup>
    loglevel = 5
    logsize = 1024
    debug = 0
    post_subject = alarm2
    pool_threads = 3
    storm_protection = 1000
</setup>
<rafale-rules>
    exclusive_rafale = yes
    <100>
        match_alarm_field = udata.message
        match_alarm_regexp = .*robot\sis\sinactive.*|.*ping\sfailed.*
        trigger_alarm_on_match = yes
        required_alarm_rowcount = 1
        required_alarm_interval = 900
        required_alarm_severity = 5
    </100>
</rafale-rules>
<alarms-template>
    <customAlarm>
        source = ip 
        prid = cdm 
        message = [correlate_field] seem to be KO!
    </customAlarm>
</alarms-template>
<database>
    active = yes
    sync_interval = 60000
    provider = MSSQL
</database>