I am new to the EMS. In the lab I have version 9.3. I tested the collection of logs from a text file. I have created a data source Generic ASP. Data Retriveal CIFS File source. I set the share on your win7. Collection of works. I created a rule with its own parser. Parser works. In the text file I have only one row (event). This line, but duplicates. SIEM reads the file every five minutes and adds there again the same event. Is this normal behavior?