An event selector is the component of an event management policy that selects one or more events to which an event management policy applies using specified event selection criteria. When an incoming event matches any of the specified event selection criteria, the cell applies the associated event management policy to the event.
Before you begin
To create an event selector and specify event selection criteria
From the Administration View, select the Event Management Polices tab.
- Select a valid node (non-cell group) from the navigation pane.
Valid nodes for event selector creation are all visible nodes except the top-level cell group node. When the Add Event Selector button in the toolbar becomes active, this is an indication that a valid node is selected.
- On the Administration View toolbar, click Add Event Selector .
The Selector Details tab, shown in the following figure, is displayed.
Selector Details tab
- In the Selector Name field, type the event selector name.
- In the Group field, type an event selector group name.
The event selector that you create in the next step is associated with the event selector group that you enter. If you enter a name of an event selector group that does not exist, that group is created.
- To the right of the Base Event Class field, click the ellipses button to display an event class chooser dialog box (shown in the following figure) from which to select the event class.
Class Chooser dialog box
- Select an event class from the tree and click OK to accept the class.
For more information about event classes, see Event and data classes.
- In the Description field, type an optional description for the event selector.
- Click Add to add event selection criteria to this event selector.
The Add Event Criteria editor is displayed.
- From the Add Event Criteria editor, type a description for the event selection criteria in the Description slot.
- In the Event Classfield, use one of the following methods to select an event class on which to base the event selection criteria:
- In the Selection Definition section, shown in the following figure, create an expression that is used to determine whether an event of the selected class is processed by the policy by choosing a Slot, Operation, and Value.
Selection Definition section of the Add Event Criteria editor
- The example expression in the following figure tests events for Windows security messages containing logon and logoff messages. You might use this expression as part of an event selector for implementation in an event blackout policy that hides these security events from display but maintains their history.
Example event selection criteria expression
- For a list and definitions of EVENT slots available for selection, see Event and data classes. For a list and definitions of the operators available for each slot, see Master Rule Language (MRL) reference.
- Click OK to save the expression and close the Add Event Criteria editor.
The event selection criteria is displayed in the Event Selection Criteria section of the Selector Details tab, as shown in the following figure.
Completed event selection criteria in Selector Details tab
- To add more event selection criteria, click Add and repeat 10 through 13.
- Click OK to save the event selector and its event selector group.