On Thu, Jan 27, 2005 at 11:19:26AM -0800, Bruce Lysik wrote: > I'm trying to understand the RECOVERED keyword. If I add it to a > rule, does it alert on both error and recovered states? Yes. It alerts when the service is in error, and sends a single message when the service returns to an OK state. Henrik