New rules
Use New rules to execute an action when a new event is received, for example, increasing the severity level for an event or updating an existing event with new event data. New rules determine whether an event becomes permanent and is placed in the repository.
Note
If an event is CLOSED before the New rule phase, a search for a duplicate event is conducted and, if found, is closed. The new event is dropped, and no subsequent rule is evaluated.
This is the default behavior. You can deactivate this behavior by setting the global configuration parameter EventAutoClose to No in the mcell.conf file. For more information about this topic, see Event repository cleanup parameters.
The New rule phase is the last opportunity to prevent an event from entering the repository. An event becomes permanent and is placed in the repository when it passes the New rule phase. In the preceding rule phases, the event is not yet registered in the repository and can be dropped. Queries return only stored events. Consequently, only stored events are:
- Displayed in the console
- Returned by the
MQUERYcommand Referenced by
UsingorUpdateclauses in MRL
The dup_detect=yes slots cannot be changed after the event becomes permanent. Such slots can be modified in the Refine and New rule phases but not in subsequent rule phases. The duplicate aspect of the event is permanently set, and as a result, the dup_detect slots cannot be modified.
# | Description |
|---|---|
1 | The incoming event is compared to the ECFs contained in the New rule. |
2 | The incoming event does not match the ECF contained in the New rule. |
3 | The incoming event matches the ECF in the New rule. |
Comments
Log in or register to comment.