Event Filter with multiple message field criteria

in WebNMS Framework • 9 years ago

Dear All:

I configured an Event Filter which sends an e-mail message if the event has a Critical or Major severity.

Modified the filter; I added the text !Alarm 1 in the "Message" field of the "Filter Criteria" window so the filter will send the e-mail message if the event has either a Critical or Major severity and the event message does not contain the Alarm 1 text. Again, it works fine. I am facing a problem when I want to add additional text patterns in the Message field, for example, !Alarm 1,!Alarm 2 which, in my understanding, will ignore events that contain either the Alarm 1 or Alarm 2 text within the message field but in this scenario the filter just ignores the message field criteria. I wondered if blank spaces were the reason of my problem so I enclosed in quotes the text patterns but got the same result. Could you, please, help me letting me know if I am doing something wrong?

Thanks a lot in advance

Diaz

Replies(4)

swaminath

Re: Event Filter with multiple message field criteria

9 years ago

Hi,

with !x, !y it will behave like an AND operation hence, if message contains both x and y will be affected, It will not behave like an OR operator. For that, you may have to define two different filters

Thanks
Nms-Support

oud12345

Re: Event Filter with multiple message field criteria

9 years ago

Thanks for the response.

One clarification:

I want to apply an AND operation, not an OR operation.

So, as the documentation says:

"! AND , :This combination can be used to obtain the exclusion of events matching two criteria."

My filter is:

!Text1,!Text2 which equals to "Message Field does not start with Text1 AND Message Field does not start with Text2".

An event with the message field containing Text1 is generated, so filter should not be triggered as the first criteria evaluates True and the second one is False; False AND True is False but the filter is activated and sends an e-mail message.

Then a second event containing Text2 is generated. Again, filter should not be triggered as first criteria is False AND the second one is True but the filter activates and sends an e-mail message.

Thanks a lot

O. Diaz

deborah

Re: Event Filter with multiple message field criteria

9 years ago

Hi O. Diaz,

We were able to reproduce the issue that you have reported. We acknowledge the issue in the document, and will make the necessary changes in the document at the earliest. There is no provision to check for multiple condition for the same field in the filters UI.

We would suggest you to set the condition for email triggering based on severity if the Message Field is configured differently for each severity.

Sorry for any inconvenience.

Regards,
Deborah CD

oud12345