Filter
Top Products
Regular Expressions in Filters: You can also use Tcl regular expressions in
filtering statements. The format of a regular expression is re:’value_fragment’.
Note: Tivoli Event Integration Facility uses an exception to the Tcl regular
expression syntax. The backslash character (\) in Tivoli Event Integration
Facility indicates that the following literal character is the character to filter
for, not some special character such as a tab. For example, \t means the tab
character in Tcl, but means t in Tivoli Event Integration Facility.
The following example shows a Filter statement with a regular expression. This
filter statement matches all events with a class name that contains TEC_ somewhere
in its name:
Filter:Class=re:’TEC_.*’
The following example shows a FilterCache statement with a narrower range. This
filter statement matches all events with a class name that contains TEC_ somewhere
in its name and has a severity of critical:
FilterCache:Class=re:’TEC_.*’;severity=CRITICAL
For more information about Tcl regular expressions, see a Tcl user’s guide.
Event Filter Examples: The following table shows some event filter examples for
a few different adapters:
Adapter Example
AS/400 Alert The following entry matches all events of the
SNA_Equipment_Malfunction class from the origin 1.2.3.4:
Filter:Class=SNA_Equipment_Malfunction;origin=1.2.3.4
UNIX Log File The following entry matches all events of the Su_Success class from
the origin 126.32.2.14:
Filter:Class=Su_Success;origin=126.32.2.14
OpenView The following entry matches all events of the OV_Message class from
the origin 126.32.2.14:
Filter:Class=OV_Message;origin=126.32.2.14
Windows NT The following entry matches all events of the NT_Power_Failure
class from the origin 126.32.2.14:
Filter:Class=NT_Power_Failure;origin=126.32.2.14
Event Buffer Filtering
When an adapter is unable to connect to the event server or IBM Tivoli Enterprise
Console gateway, it sends the events to a file if the BufferEvents keyword is set to
YES. You can filter events sent to a cache file, similar to filtering events for the
event server by using the FilterCache keyword.
There are no default event cache filters in the configuration files shipped with
adapters.
The following procedures describe how to filter events with the FilterCache and
FilterMode keywords, when the event server is unavailable:
v To cache specific events:
1. Set FilterMode to IN.
2. Set BufferEvents to YES (the default value).
Chapter 1. Understanding Adapters 15