In “Chapter 6: Automating Tasks Using Schedules and Events > Understanding events > Defining trigger conditions for events”, the Sybase IQ example should be:
create event SecurityCheck type ConnectFailed handler begin declare num_failures int; declare mins int; insert into FailedConnections( log_time ) values ( current timestamp ); select count( * ) into num_failures from FailedConnections where log_time >= dateadd( minute, -5, current timestamp ); if( num_failures >= 3 ) then select datediff( minute, last_notification, current timestamp ) into mins from Notification; if( mins > 30 ) then update Notification set last_notification = current timestamp; call xp_sendmail( recipient='DBAdmin', subject='Security Check',"message"= 'over 3 failed connections in last 5 minutes' ) end if end if end