Event Tracking Tables

Event tracking tables are buffers that store combinations of attributes with timeouts for each entry. They track the properties of communication events across several traffic flows. Using individual timeouts for the entries, changes can be tracked over time and the entries can be automatically removed once the timeout has elapsed.

Navigate to Policy > Event Tracking Tables to see an overview of the event tracking tables currently defined in active correlation scenarios. The tables are grouped by scenario.

Tip

Click the number in the Counts column to see the entries that the event tracking table currently contains. If you want to delete the content of the event tracking table, click RESET STATE in this view.

To edit the settings of an existing event tracking table, click edit_icon in the last table column.

Note

New event tracking tables can only be created in correlation scenarios. Navigate to Policy > Advanced Correlation. Select the required scenario and double-click its name to access its settings. In the Event Tracking Tables tab, click Add.

Event Tracking Table Settings

When you configure an event tracking table, the settings screen is displayed with the following options:

Field

Description

Name

Enter the name of the event tracking table.

Note

Optional: Add a short description of the event tracking table.

Retention Time for Event Tracking

Specify in seconds for how long events will be stored in the event tracking table. The retention time expires individually for all entries. If you set the retention time to 0, events are stored permanently.

Primary Attribute Type

From the drop-down list, select the type of the primary attribute to be stored in the event tracking table. You can select any combination of the available attribute types.

Maximum Number of Primary Attributes

Enter the maximum number of primary attributes that may be stored in the event tracking table.

Secondary Attribute Type

From the drop-down list, select the type of the secondary attribute to be stored in the event tracking table. You can select any combination of the available attribute types.

Maximum Number of Secondary Attributes per Primary One

Enter the maximum number of secondary attributes that may be stored per primary attribute in the event tracking table.

The buttons at the bottom of the screen allow you to store your changes (SAVE) or to discard them (CANCEL).

Note

As long as an event tracking table is used in rules, it is not possible to change its Primary Attribute Type and Secondary Attribute Type.

Additional References: