Ironport ESA Alert question

Discussion created by ksaunders on Nov 30, 2011
Latest reply on Dec 19, 2011 by ksaunders
Hi all, I am coding an alert for ESA, and have a question about which variable I should be using. Basically, I want to monitor for the Message ID 'entered', but only for some specific Session IDs. When I look in the Filter options, Session ID is not an option. These are my options: Action Event Time Event Type Field 20 Field 21 Field 22 info poolid User Name [CONTENT] Event Type seems like the most likely candidate, but I wanted to know if anyone else had some more insight into this for me. Thanks, Kent