New Sessions Per Minute Per Application Event Source

Purpose

Triggers an alert both when the number of new sessions created for a specific application exceeds the given upper limit, and when it later goes below the given lower limit.

ATTENTION The limit must be exceeded for some time before vWAF triggers the alert (hysteresis characteristics). Therefore, there are no alerts for individual minutes where the number of new sessions is high just by coincidence.

For more information regarding adding and editing Event Sources, see Editing Event Sources.

Attributes

Attribute	Meaning
upper limit	vWAF triggers an alert if for some time there's an average of more new sessions for an application than stated here.
lower limit	If an alert has been triggered, vWAF doesn't trigger any additional alerts for the same application until the average of new sessions per minute goes below the limit stated here. When the number of new sessions has fallen below this limit for some time, there's a second alert.
msg prefix	Here you can enter some text, which is added to the beginning of the issued alerts when the upper limit is exceeded. The default text here is "Created sessions per minute for the following applications are over the configured limit:".
msg under prefix	Here you can enter some text, which is added to the beginning of the issued alerts when the lower limit is reached again. The default text is "Created sessions per minute for the following applications are under the configured limit:".