Sample RTA Rules

Reduce Session Count rule

This rule reduces the session count by approximately 10 percent.

Note: The STOPRULES directive stops further processing of rules if the rule is true.

<RULE NUM="1" STATUS="DISABLED" DESCRIPTION="Delete 10% of Sessions"
   STOPRULES="YES">
<GROUP TYPE="SessPCT" PERCENT="10" >
</GROUP>
<GROUP TYPE="DELETE" >
</GROUP>
</RULE>

HTTP 400 Errors or Greater rule

This rule tests for HTTP errors 400® or greater, except 404 errors, which can frequently occur due to user typos.

The action is to create an entry in the NT Event Log:

<RULE NUM="5" STATUS="DISABLED" DESCRIPTION="HTTP Errors">
<GROUP TYPE="REQTest" REQF="StatusCode" REQOP="GT" REQVAL="399" >
</GROUP>
<GROUP TYPE="REQTest" REQF="StatusCode" REQOP="NE" REQVAL="404" >
</GROUP>
<GROUP TYPE="EventLog" TYPE="WARNING" PRIORITY="Normal"
   CATEGORY="3xx - 4xx HTTP Errors">
</GROUP>
</RULE>

Long Page Generation Time rule

This rule tests for Page Generation time greater than 60 seconds:

<RULE NUM="6" STATUS="DISABLED" DESCRIPTION="Page Response Time &gt 300 Secs">
<GROUP TYPE="REQTest" REQF="TL_ResponseTime" REQOP="GT" REQVAL="300" >
</GROUP>
<GROUP TYPE="EventLog" TYPE="ERROR" PRIORITY="Severe"
   CATEGORY="Page Generation Error">
</GROUP>
</RULE>

HTTP 500 errors or Greater rule

This rule tests for HTTP errors 500 or greater, which are internal server errors. In addition to creating an ERROR type event log entry, it also creates an APPEvent.

The NOT operator is used in this rule.

<RULE NUM="8" STATUS="DISABLED" DESCRIPTION="HTTP 500 Errors">
<GROUP TYPE="REQTest" NOT="YES" REQF="StatusCode" REQOP="LT" REQVAL="500" >
</GROUP>
<GROUP TYPE="APPEvent" TYPE="ERROR" PRIORITY="High"
   CATEGORY="HTTP 500 Errors">
</GROUP>
</RULE>

Search Response Buffer rule

This example searches the response buffer for the string Partial Transaction, only for server non-cached pages (HTTP Status Code 302).

<RULE NUM="9" STATUS="DISABLED" DESCRIPTION="Partial Transaction" >
<GROUP TYPE="REQTest" REQF="StatusCode" REQOP="NE" REQVAL="302" >
</GROUP>
<GROUP TYPE="RSPSrch" SRCHSTR="Partial Transaction" SRCHCASE="YES"
   REGEXPR="NO" >
</GROUP>
<GROUP TYPE="Email" To="John@doe.com,Mary@doe.com" From="From@doe.com"
   Subject="Partial Server Transaction" Hostname="Mailhost" Port="25">
</GROUP>
<GROUP TYPE="EventLog" TYPE="WARNING" PRIORITY="Low"
   CATEGORY="Partial Transaction">
</GROUP>
</RULE>

Search Request Buffer rule

This example searches the REQ buffer for the string APPEVENT TYPE=&qout, as found in an APPEvent.

The ReqTest does only name/value operations.

<RULE NUM="10" STATUS="DISABLED" DESCRIPTION="Partial Transaction" >
<GROUP TYPE="RSPSrch" SRCHSTR="APPEVENT TYPE=&qout" SRCHCASE="YES"
   REGEXPR="NO" SRCHREQ="YES" >
</GROUP>
<GROUP TYPE="EventLog" TYPE="WARNING" PRIORITY="Low"
   CATEGORY="APPEvent Found">
</GROUP>
</RULE>