correlation composer

[koleta]

Hi all!

I have two questions about correlation composer:

1 - I have created a Enhance correlation in order to change the value of a var of a particular event, then I want to correlate it with Pairwise using that modified var. I have problems becouse the event that input from the Enhace correlation does not have that modified var, the log events shows this alarm:

# eventid(0:3456)
+0
!1
Trap-PDU {
enterprise {1 3 6 1 4 1 1872 2 5 7},
agent-addr internet : "\x0A\x04\x00V",
generic-trap 6,
specific-trap 14,
time-stamp 307044,
variable-bindings {
{
name {1 3 6 1 4 1 1872 2 5 4 1 1 2 2 1 1},
value simple : number : 1
},
{
name {1 3 6 1 4 1 1872 2 5 4 1 1 2 2 1 2},
value application-wide : address : internet : "\x01\x01\x01\x01"
},
{
name {1 3 6 1 4 1 1872 2 5 4 1 1 2 2 1 12},
value simple : string : "prueba"
},
{
name {1 3 6 1 4 1 1872 2 5 4 1 1 4 5 1 5},
value simple : number : 71717
},
{
name {1 3 6 1 2 1 1 5},
value simple : string : "localhost"
},
{
name {1 3 6 1 2 1 1 6},
value simple : string : ""
},
{
name {1 3 6 1 2 1 1 4},
value simple : string : ""
},
{
name {1 3 6 1 3 1057 1},
value application-wide : address : internet : "\x7F\x00\x00\x01"
}
}
}
% ber:Trap-PDU:

The only diference between the original and the modified one is the added var:

name {1 3 6 1 3 1057 1},
value application-wide : address : internet : "\x7F\x00\x00\x01"

Finally, my question: Is there any way of check that modified var in PairWise?

2 - Is there any way of acknoledge or delete an event using correlation composer, something like Pairwise?


thank you in advance.