The Event Rule and report events do not match

Problem

1. Scenario 1: The event rule did not trigger an alert, but you can see the event in the Event Rule Report.
2. Scenario 2: You see an event in the Events panel, but it does not appear in the Event Rule Report.

Cause

• Event rules process live data only. They do not consider buffered data.
• Reports (e.g., EV1000) analyze all data, including buffered data.
  • Events Panel: Displays events derived from live data in real time.
  • Reports: Include events based on the complete tracks of processed data.

Data Timestamps

• In the Track Points panel, enable the Received time column to see:
  1. Time: When the tracker sampled the message locally.
  2. Received Time: When the server received the message.
• Discrepancies arise when track points are not sent in the correct order or are delayed.

Solution

1. Ensure Tracks Send Data in Order:

   • Configure your trackers to always send messages sequentially and promptly to minimize discrepancies.

2. Understanding Alerts vs. Reports:
   Here's how the system handles tags and asset data differently in alerts and reports:

Event Rule Alerts

• Trigger Mechanism:

  • Alerts activate based on live data when conditions in the event rule are met.
  • Alerts cannot trigger from past data or buffered information.

• Tag Dependency:

  • Alerts are triggered only for assets that are part of the tags assigned to the event rule.
  • If a asset is not in the assigned tags, it will not trigger any alerts or notifications.

Event Rule Reports

• Data Inclusivity:

  • Reports analyze historical and buffered data for all assets.
  • Reports are not restricted by the tags assigned in the event rule setup.

• How It Works:

  • If you run a report for a asset not included in the tags, the system evaluates the asset’s historical data against the event rule’s conditions.
  • Matching events will be displayed in the report, even if they were not part of the original alert configuration.

• Database Behavior:

  • Once a report is generated, the matching data is stored in the database.
  • Future queries will retrieve this data, allowing visibility of matching events.
  • However, if no report has been run, matching data for assets outside the tags will not appear in the database.

Key Takeaways

• Alerts are based on real-time data and restricted to assets in the assigned tags.
• Reports can include any asset and are based on a comprehensive evaluation of historical data.
• Data discrepancies between alerts and reports are often due to how live and buffered data are processed.

By understanding these distinctions, you can better configure event rules and interpret the data shown in alerts versus reports.