periodic summary logging with table and after?

Yeah, so I've made a rule that's mostly like that example now. I inherited a roughly hacked version of your original rule and have basically totally re-written it, in many less lines. I'm incrementing a single table value as well as logging all connections to a countable subtable which looks like it might be able to be improved from that link. I found that just using the size of the table itself didn't work quite right, probably as it created duplicate values or something.

 

 

But really, it's the logging I'm stuck on now.

 

 

I don't want to log the number of rejections if there have been no rejections, and I also want to log summaries of ALL the occurrences of the rejections. So, I figured when I get an initial rejection I count it (table incr ... ) and set an after timer for 60 seconds or so. further rejections when a timer is known to be set just get counted, and when the after timer executes it clears the current count and the timer, so the next rejection, be it in one second or one month from then, will cause the next logging event, without losing sight of any rejection occurrence. Does that make sense as a reasonable approach to do this?