Products Affected

All ELM Enterprise Manager products

Issue

How to determine where to place the exclude filter for the desired result.

Facts

  1. Exclude Filters take precedence over Include Filters.
  2. When an event is received at the ELM Server, it is checked against event filters by the ‘Index’ value in alphabetical order. (You can view this hexadecimal GUID on the Properties tab in the properties of an Event Filter.) ELM will continue checking the event against all event filters even after a match is found. This is not a first match found type of behavior, since multiple event filters can match a single event and multiple views (and notifications) can be affected.

Tip

For quick indentification, when creating a name for an exclude filter begin with “exclude.”

Results

  1. Do not collect the event at all.
    1. The agent will not collect this event. This will bypass ELM and the database completely and ELM will not be able to report on ANY of these events.
    2. The database will be smaller because it is not retaining these events.
  2. Exclude the specific event from the database but not from the ELM Server. ◦This will bypass the database completely, these events will NOT be retained.
    1. The ELM server will process and generate information such as Notifications.
    2. The database will be smaller because it is not retaining these events.
  3. Exclude the specific event from an event view but write it to the database. ◦These events are still written to the database but just hidden from some of the Event Views.
  4. Exclude the specific event from a Notification.

Procedure

  1. To configure the agent so it will not collect the event at all:
    Note: The criteria is in a Monitor Item and not an Event Filter. If there are multiple Event Collectors or Event Alarms assigned to an Agent, then ! is needed to exclude an event. If more than 1 event ID needs to be excluded, ampersands, not pipes are needed. For example: !*2001*&!*2002*
    Use the ! (for not) in the Event Filter Criteria tab in the Monitor item “Event Collector.”
    For Example:
    To exclude the specific Event ID 2001 from all agents, enter !*2001* in the ‘Event ID is:’ box.
  2. Exclude the specific event from the database but not from the ELM Server.
    Create an Event Filter(s) that details all the classes of Events that you wish to exclude from the database, then apply that filter as an Exclude Filter to every Event View you have.
  3. Exclude the specific event from an event view but write it to the database.
    ELM Manager | Results | Event Views | “your specific event view” | right click Exclude Event Filters and select New | Event Filter. Enter your filter criteria in the Event Filter Definition screen.
    For Example:
    To exclude the specific Event ID 2001 from “your specific event view,” enter *2001* in the ‘Event ID is:’ box.
  4. Exclude the specific event from a Notification.
    ELM Manager | Notification and click on the + to expand “your specific event notification rule,” right click Exclude Filters | New | Event Filter.
    Enter your filter criteria in the Event Filter Definition screen.