Re: Dispatching of events
On Wednesday 14 June 2006 08:41, Steve wrote:
So, is there a way to tell when all messages for a particular event
have
been dispatched?
This was recently discussed on the list. All the records for the same event
come out one after another. There is a chance that some other event may sneak
in during the dump. But you can pretty well assume that if there are no more
records emitted with the same serial number/time stamp within 2-3 seconds,
you have a complete event.
Also, is it safe to assume a type 1300 message is always the first
message pertaining to a rule violation?
Maybe not. I'd not make that assumption just to be safe. Collect the full
event's information, then look at the message types.
-Steve