Message overrides

Message overrides alter the message data, instead of removing messages from the system as filters do.

Related topic

Using BMC Defender Server applications

On the Messages > Config > Overrides tab you can access the following override options:

  • Address—The operator can set an address override that replaces the address of the incoming message with some other address, especially useful for systems relying on NAT (Network Address Translation).
  • Facility—The operator can set a facility override that replaces the facility code of the incoming message with some other facility, including a User Defined Facility described. Since facility codes offer a main way of quickly correlating data, this provides a large amount of flexibility associated with data organization.
  • Severity—The operator can set a severity override that replaces the severity of the incoming message with some other severity. Since severities are sometimes badly assigned by system vendors, this provides a direct method of adjusting message severities up or down as might be appropriate.
  • Text—The operator can blank out certain fields of a message using a text override. This allows the operator to blank out certain fields within a message, such as a credit card number or user password. The text is eliminated from the message and not log on the system.

Important

Each override can match an address, facility, severity, and text pattern. Therefore, the order in which overrides are created is important: first, the message address is overridden, followed by the facility, the severity, and then the text. So a severity override might be applied to a message, based upon a match address, that was first assigned by an address override.

In addition to the basic override functions, the various override facilities have substantially advanced functions. For example, address overrides can occur dynamically by parsing the message content. Text overrides provide certain features to automatically mask out user names (to promote user anonymity and user privacy). These functions are typically available under the Advanced tab of the screens.

In particular, the address overrides permit you to change the mode that address values are displayed to support DHCP and non-static IP addresses.

This section provides information about the following topics:

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*