Hi all,

I'd like to feed our on-duty staff with only critical network information.
I've created a ruleset, which forwards out network events from critical
nodes (routers, switches, RMON agents), other events are discarded. Critical
nodes are part of corresponding collection.
Structure of the ruleset are quit simple:


Event ----- (is contained in collection "Router") -------------> forward
+-------------(is contained in collection "Switches") -----> (is RMON
trap) -------> forward

+-------------------> (is not RMON trap) -----> (severity >3) --->forward

But, after activation of this ruleset, I saw considerable delay in
processing events. Sometimes event time shift (delay between when event
really arise in the network and displayed in either Event window) may reach
10 min.

Does anybody can give me any idea on how fight this problem out?

Sincerely yours,

Igor Podlivalchev