there's a lot more to it, but you can see it like this:
A monitor shows a state of an object and has 2 or 3 states of which one is healthy. A rule just triggers on some kind of event.
When you just look at alerts, you can see that some alerts come from rules and some from monitors. Alerts from rules will never auto close and can get a high repeat count as each "new event" on which the rule triggers creates a new alert. Alerts from a monitor
are generated on the statechange of the monitor and generally autoclose when the monitor returns to a healthy state. Typically these alerts will never have a repeat count (as the alert is only triggered on a statechange). Especially for monitors there are
exceptions, like "manual reset" monitors (there's no healthy state defined other then a reset of the monitor; the citrix mp and the latest dhcp mp have loads of these monitors) and monitors that don't auto close alerts which could generate repeat
counts, but for 90+% it works as above.
Rob Korving
http://jama00.wordpress.com/
