PollCat NetLink II - User’s Guide
9.5. Defining Alarm Filter Clues
Alarm Filter Clues describe speciﬁc criteria that NetLink II will use to
determine if each record should be counted as a match. Up to sixteen clues
can be deﬁned for each Alarm Filter. When an Alarm Filter is assigned to
an input port, all data received by that port will be monitored. NetLink II
will scan each record to determine if it matches any of the deﬁned Alarm
Clues. Records that match clues are ﬂagged and counted. When data is
released to the polling device, alarm records can be sorted according to the
name of the clue that was matched.
When deﬁning clues, the following factors should be considered:
• Clue Name: Names should describe the type of call the clue
• Threshold: The number of times this type of call must occur in order
to generate an alarm. Note that the Alarm Clue Deﬁnition menus
allow you to deﬁne a separate Threshold value for Business Hours and
• Duration (Alarm Counter Reset Time): The Duration parameter
determines how often the counter for each clue will be reset. Note
that the Alarm Clue Deﬁnition menus allow you to deﬁne a separate
duration value for Business Hours and Non-Business Hours.
• Match Parameters: The qualities that identify a suspect call. For
example, long distance calls are easily recognized because they begin
with the number one. Call characteristics are expressed in the form of
an equation, which includes the following elements:
Variable(s): One or more variables from the Alarm Filter Format
or one or more Real-Time variables. Variables determine which
ﬁeld(s) will be monitored. For example, the variable may represent
the ﬁeld for the number dialed.
Operator(s): One or more of the logical/relational operators
described in Section 9.6.
Parameter(s): A description of the characteristics that determine
whether each record is counted as a match. For example, calls to a
speciﬁc phone number, or calls made after a speciﬁc time.
• Action Parameters: A Series of parameters that determine how
NetLink II will react when the counter for this clue reaches the deﬁned
threshold. NetLink II can send an SNMP Trap or email message, call
a modem or pager, or contact the user via the Console Port. For more
information on Alarm Actions, please refer to Section 12.