Junos OS event policies can be configured to execute an action based on the number of times a specified event occurs within a defined time interval.

The within statement defines the time interval used for event-count evaluation, while the trigger statement determines when the event policy action is executed.

The available trigger options are:

• on
• after
• until

Understanding the behavior of these options is important when configuring event policies, particularly for events such as ping_test_completed and ping_test_failed, which can occur multiple times within a short period.

The event policy action may not be triggered as expected when the configured within and trigger conditions do not match the actual number of events being generated.

For example, consider:

set event-options policy LINK_UP events ping_test_completed
set event-options policy LINK_UP within 60 trigger on
set event-options policy LINK_UP within 60 trigger 1

This configuration monitors the ping_test_completed event and triggers the policy when the number of matching events received within the applicable 60-second interval equals 1.

If additional matching events are received within the same event-count interval, the event count becomes greater than 1 and the trigger on 1 condition is no longer satisfied.

Understanding within <seconds>

The within statement specifies the time interval over which Junos evaluates the number of matching events.

For example:
set event-options policy LINK_UP within 60

specifies a 60-second event-count interval.

Junos counts the matching events received by the event process within this interval and evaluates the configured trigger condition against that count.
The syntax is:
within <seconds> { trigger (after | on | until) <event-count>; }

For example:
set event-options policy LINK_UP events ping_test_completed
set event-options policy LINK_UP within 60 trigger on
set event-options policy LINK_UP within 60 trigger 1

The important point is that within 60 defines the time interval, while trigger defines the event-count condition.

trigger on

Syntax:

within 60 {
    trigger on 1;
}

trigger on N executes the event policy when the number of matching events received equals N.

For example:

set event-options policy LINK_UP within 60 trigger on
set event-options policy LINK_UP within 60 trigger 1

The action is triggered when the event count reaches exactly 1 within the applicable 60-second interval.

Example:

Event 1 → Count = 1 → Action triggered

If additional matching events are received within the interval:

Event 1 → Count = 1 → Action triggered
Event 2 → Count = 2 → Condition "on 1" not satisfied
Event 3 → Count = 3 → Condition "on 1" not satisfied

Therefore:

trigger on 1

means:

Trigger when the matching-event count equals 1.

trigger after

Syntax:

within 60 {
    trigger after 1;
}

trigger after N executes the event policy when the number of matching events received equals N + 1.

For example:

set event-options policy LINK_UP within 60 trigger after
set event-options policy LINK_UP within 60 trigger 1

The action is triggered when the matching-event count reaches 2.

Example:

Event 1 → Count = 1 → No action
Event 2 → Count = 2 → Action triggered

Similarly:

trigger after 3

triggers the policy when the matching-event count reaches 4.

Juniper's documented event-count example uses trigger after 4 to execute the policy when the fifth matching event is received within the configured interval.

Therefore:

trigger after N

means:

Trigger when the matching-event count reaches N + 1.

trigger until

Syntax:

within 60 {
    trigger until 3;
}

trigger until N executes the policy each time a matching event is received until the number of matching events reaches N. Once the count reaches N, subsequent matching events do not execute the policy.

For example:

set event-options policy LINK_UP within 60 trigger until
set event-options policy LINK_UP within 60 trigger 3

Behavior:

Event 1 → Count = 1 → Action triggered
Event 2 → Count = 2 → Action triggered
Event 3 → Count = 3 → No action
Event 4 → Count = 4 → No action

Therefore:

trigger until 3

means:

Trigger the action while the event count is below 3 and stop triggering once the count reaches 3.

Comparison of Trigger Options

Assuming:

within 60

the behavior can be summarized as follows:

In simple terms:

trigger on N
→ Action when count = N

trigger after N
→ Action when count = N + 1

trigger until N
→ Action while count < N
→ Stop when count = N

Example with ping_test_completed

Consider:

set event-options policy LINK_UP events ping_test_completed
set event-options policy LINK_UP within 60 trigger on
set event-options policy LINK_UP within 60 trigger 1

If ping_test_completed is generated once within the applicable 60-second interval:

ping_test_completed → Count = 1 → Action triggered

If the event is generated multiple times:

ping_test_completed → Count = 1
ping_test_completed → Count = 2
ping_test_completed → Count = 3

only the event that causes the count to reach 1 satisfies trigger on 1.

This is particularly important when RPM-generated events such as ping_test_completed or ping_test_failed are generated repeatedly.

Preventing Repeated Configuration Changes

When an event policy performs a configuration change, trigger on can be combined with trigger until to prevent the same action from being repeatedly executed.

For example:

set event-options policy LINK_UP within 60 trigger on
set event-options policy LINK_UP within 60 trigger 3
set event-options policy LINK_UP within 65 trigger until
set event-options policy LINK_UP within 65 trigger 4

Here:

within 60 trigger on 3

causes the configuration change when three matching events occur within 60 seconds.

The additional:

within 65 trigger until 4

prevents subsequent matching events from repeatedly triggering the same configuration change. Juniper documents this combination specifically for event policies that perform configuration changes.

This can help avoid repeated configuration changes or commit loops when the monitored event continues to be generated.

Troubleshooting

When an event policy does not trigger as expected, verify:

1. The configured event:

show configuration event-options policy <policy-name>

2. The actual number of matching events being generated.
3. The configured within interval.
4. The configured trigger type:

trigger on
trigger after
trigger until

5. The configured event count.
6. Whether multiple matching events are being generated within the configured interval.

For example, if the configuration is:

set event-options policy LINK_UP events ping_test_completed
set event-options policy LINK_UP within 60 trigger on
set event-options policy LINK_UP within 60 trigger 1

and multiple ping_test_completed events are generated within the interval, the event count can exceed 1. Therefore, subsequent events do not satisfy trigger on 1.

The actual event sequence and timing should be checked when troubleshooting event-policy behavior.

Summary

The within and trigger statements work together to determine when an event policy is executed.

within <seconds>
→ Defines the event-count time interval.

trigger on N
→ Execute when count = N.

trigger after N
→ Execute when count = N + 1.

trigger until N
→ Execute while count < N.

Understanding the event count within the configured interval is essential when configuring event policies, especially when the monitored event can be generated multiple times within a short period.