Hello all.

I hope for your help.

I get events thru Cisco IOS Event Collector 4.3.

Events as "Interface FastEthernet0/7, changed state to up", "Interface FastEthernet0/7, changed state to down" and so on...

I need such rule, which will create alert when Interface changed state to down, but not changed state to up for 5 minutes, for example.

I tried create "X not followed by Y" and "Y not preceded by X" rules, but that rules check events, which was obtained. And I need rule, wich will check, that there was no events with "changed state to up" in description.

Thank you.