# Generate rule in realtime without delay

**URL:** <https://forum.suricata.io/t/generate-rule-in-realtime-without-delay/1776>\
**Category:** Help\
**Created:** [October 2, 2021, 6:31am UTC](https://forum.suricata.io/t/generate-rule-in-realtime-without-delay/1776 "2021-10-02T06:31:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![arafatx](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/arafatx/32/563_2.png) [@arafatx](https://forum.suricata.io/u/arafatx)\
**Post date:** [October 2, 2021, 6:31am UTC](https://forum.suricata.io/t/generate-rule-in-realtime-without-delay/1776/1 "2021-10-02T06:31:55Z")

</div>

Hai guys, I setup a suricata simple rule (for testing) like follow:

alert tcp any any → any 23 (msg:“TELNET connection attempt”; sid:1000003; rev:10;)

Now, if I connect my server via telnet. eg:

`telnet 1.2.3.4`

The rule is working perfectly, I can see fast.log is generated from the IP about the TELNET connection attempt

But now I want to understand how long this rule will trigger again after the last one. I tried to run `telnet 1.2.3.4` few seconds after that it will not generate that rule in fast.log but maybe after 1 minute or so. I searched about this and I think maybe this is related (or maybe I’m wrong) [10.2. Global-Thresholds — Suricata 6.0.0 documentation](https://suricata.readthedocs.io/en/suricata-6.0.0/configuration/global-thresholds.html)

Is there a way to make this rule generated in realtime when I use `telnet 1.2.3.4` ?

---

<div class="post-metadata">

**Author:** ![arafatx](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/arafatx/32/563_2.png) [@arafatx](https://forum.suricata.io/u/arafatx)\
**Post date:** [October 2, 2021, 6:37am UTC](https://forum.suricata.io/t/generate-rule-in-realtime-without-delay/1776/2 "2021-10-02T06:37:42Z")

</div>

Sorry guys, I think this is due to my network issue, I can see that the rule is actually generated in realtime. Solved.