The EventRules configuration variable allows you to define a list of persistent rules in the agent where each rule can be one of the following:
Format and type of data | /EventRules/sourceCatalog/sourceClass/objectPath |
---|---|
Values (no default) | SUPPRESS |
Minimum and maximum | Not applicable |
Dependencies | None |
Recommendation | None |
Note
Only ONE rule can exist for a given KM context, event catalog and event class. This is inherently enforced by the fact that only one such pconfig variable can exist.
If many rules exist that match the objectPath of an event, the following order is applied:
If <objectPath> is '*' (an asterisk), any event with the same catalog and class will match the rule.
To suppress an event means that you want to suppress event source catalog, source class anytime the event origin matches objectPath.
When an event is suppressed following tasks are observed:
Some standard events that are used internally by the agent (example remote PSL execution) can be suppressed (with limitations):
Some of the events generated for PATROL objects that are blacked out but can be suppressed (with limitations):
Note
If you suppress any of the above mentioned events, neither will any event get generated nor will any event actions run. Only range evaluations will take place and recovery events will get generated. Example:
The event replacement rule allows you to replace standard events with more meaningful events for each KM. To replace an event means that you want to replace event source catalog, source class with event replacement catalog, replacement class anytime the event origin matches objectPath.
If MY_CAT/MyClass does not exist, the original event will be published.
It is expected that event class "MyClass" defines the same number of arguments as in event class "11".
Some standard events are used internally by the agent (example remote PSL execution) and, as such, cannot be replaced:
To substitute event text means that you want to substitute the event description of event source catalog, source class with the substitute text when the event origin matches objectPath. Event text substitution allows you to provide event descriptions that are in context of your environment and more meaningful.
As in the event replacement rule, it is expected that the substitute description defines the same number of arguments as in the original description.