MRL event selection clauses
Whether the event being processed triggers the execution of the rule depends on the events's conformance with the selection criteria specified in the rule.
For example, suppose that an event class is defined as follows:
Event selection criteria example
MC_EV_CLASS :
APPLICATION_UP ISA APPLICATION_EVENT DEFINES
{
severity: default = INFO;
};
END
APPLICATION_UP ISA APPLICATION_EVENT DEFINES
{
severity: default = INFO;
};
END
The engine receives the following event:
APPLICATION_UP;
mc_host=babble;
...
status=OPEN;
END
mc_host=babble;
...
status=OPEN;
END
The following rule will accept the instance and will be evaluated:
filter application_events : PASS
APPLICATION_EVENT ($APEV)
where [
....
]
...
APPLICATION_EVENT ($APEV)
where [
....
]
...
Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*