2.16.1 Common exclusion-conditions page
The Common exclusion-conditions page is used to set common exclusion-conditions in extended mode.
Note that if no common exclusion-conditions are set in extended mode on this page (that is, no event conditions are displayed in the Event conditions list), all JP1 events will be filtered out. To perform filtering, make sure that at least one condition is set.
|
The following describes the items displayed on the Common exclusion-conditions page.
- Event conditions list
-
A list of common exclusion-conditions in extended mode is displayed. Conditions that are higher in the list have higher priority.
The Attribute name column displays the attribute name of each event condition. If an extended attribute is specified for a condition, E is prefixed to the character string that the user specified as an attribute name. For example, if TEST is specified as the name of an extended attribute, E.TEST is displayed.
The Attribute value column displays the value or values of each attribute. If there are multiple values, each value is separated by a comma (,).
The Condition column displays one of the following event condition comparison methods: First characters, Match, Does not match, Is contained, Is not contained, Regular expression, Period, and Time.
- Read From Selected Event
-
Click this button to reflect the attribute values of the JP1 event selected in the Event Console window into the Event conditions list. The following table describes how attribute values are reflected into the list. The byte counts in the table are for Shift-JIS-encoded character strings.
Table 2‒12: Behavior when the Read From Selected Event button is clicked Event attribute values
Behavior
Length
Control character#1
4,096 or fewer bytes
Not included
-
All event attribute values are reflected into the list.
-
For an attribute for which an optional condition can be specified, Match is selected.
Included
-
The character string before the first control character is reflected into the list.
-
For an attribute for which an optional condition can be specified, First characters is selected.
4,097 or more bytes
Not included
-
The first 4,096 bytes#2 are reflected into the list.
-
For an attribute for which an optional condition can be specified, First characters is selected.
Included in the first 4,096 bytes
-
The character string before the first control character is reflected into the list.
-
For an attribute for which an optional condition can be specified, First characters is selected.
Included in the 4,097th and following bytes
-
The first 4,096 bytes#2 are reflected into the list.
-
For an attribute for which an optional condition can be specified, First characters is selected.
- #1:
-
Whether the event attribute values include control characters such as line breaks and tabs.
- #2:
-
If the boundary between the 4,096th and 4,097th bytes splits a multi-byte character, the character is not reflected into the list.
Note that display items of the selected JP1 event might be mapped to extended attributes in the Event-Information Mapping Definitions window. In this case, neither the values of the display items nor the values of the mapped extended attributes are reflected into the Event conditions list. For details about event-information mapping definitions, see 5.1.3 Displaying extended attributes of JP1 events (mapping of event information) in the Job Management Partner 1/Integrated Management - Manager Administration Guide.
-
- Add
-
Click this button to add the event condition selected in the lower list to the Event conditions list. Added event conditions are displayed at the bottom of the Event conditions list. The event conditions that have already been in the Event conditions list are not added. A maximum of 256 event conditions can be added.
- Delete
-
Click this button to delete the selected event condition.
- Up
-
Click this button to move the event condition selected in the Event conditions list up by one line. Use this button to change the priority of the event conditions.
- Down
-
Click this button to move the event condition selected in the Event conditions down by one line. Use this button to change the priority of the event conditions.
- Area for editing event conditions
-
This area is used to edit event conditions in common exclusion-conditions in extended mode. The pattern of this area changes according to the selected attribute. The patterns that can be displayed are described below.
Note that if the Common Exclusion-Condition Settings (Extended) window is opened by choosing Exclude by Common Exclusion-Conditions, the attribute names and values for the JP1 event selected in the source window are automatically set as conditions. The attribute names and values that are set automatically can be set by using the common-exclusion-conditions auto-input definition file. The behavior of the system when an attribute value is longer than 4,096 bytes (when Shift-JIS encoded) or includes control characters is the same as when the Read From Selected Event button is clicked. For details about this file, see Common-exclusion-conditions auto-input definition file (common_exclude_filter_auto_list.conf) in 2. Definition Files in the manual Job Management Partner 1/Integrated Management - Manager Command and Definition File Reference. In the drop-down list on the right, Match is selected as the comparison method for the specified character string if the total length of the attribute values does not exceed 4,096 bytes. If 4,096 bytes (when Shift-JIS encoded) is exceeded or the attribute value contains a control character, First characters is selected.
- Character string editing
-
This pattern applies when one of the following attributes is selected:
-
Event source host name
-
Source host
-
Object name
-
Root object name
-
Occurrence
-
User name
-
Message
-
Product name
-
Source user name
-
Source group name
-
Source IP address
-
Object ID
-
Return code
When specifying an IPv6 address for Source IP address, alphabetic characters must be lower case, as shown below:
0011:2233:4455:6677:8899:aabb:ccdd:eeff
You cannot specify an IP address in abbreviated form like the one shown below:
2012:7:8::a:b
If the integrated monitoring database and IM Configuration Management database are enabled, you can specify a business group name in path format for Source host and Event source host name. Either Match or Does not match can be selected as a condition. If these databases are disabled and the selected condition is not Match or Does not match, a business group name specified in path format is treated as a host name.
Note that Event source host name can be specified only if event source host mapping is enabled. If this mapping is disabled, conditions for Event source host name can be specified by specifying JP1_SOURCEHOST as the attribute name when the area for editing event conditions is in the Extended-attribute editing pattern.
A character string of 64 kilobytes or less (when Shift-JIS encoded) can be specified. Alphabetic characters are case sensitive.
You can specify a maximum of 100 character strings by using a comma (,) as a separator. However, only one character string can be specified if Regular expression is selected.
To specify a comma (,) or backslash (\) as an ordinary character, prefix it with a backslash (\). That is, to use a comma (,), enter \,. To use a backslash (\), enter \\.
From the drop-down list on the right, select a condition for the specified character string from First characters, Match, Does not match, Is contained, Is not contained, and Regular expression.
If Regular expression is not selected in the drop-down list on the right when ON is set for the -ignorecasehost option of the jcoimdef command, the case of alphabetic characters is ignored for the following attributes:
-
Source host
-
Event source host name
-
- Severity-level editing
-
This pattern applies when the following attribute is selected:
-
Event level
Which events are filtered out depends on the selected radio button.
-
If All events for which severity has been defined is selected:
All events for which severity (an event level) is defined are filtered out.
-
If Specify the severity is selected:
Events assigned a specific severity are filtered out.
You can select Emergency, Alert, Critical, Error, Warning, Notice, Information, or Debug as the severity.
-
If JP1/SES events is selected:
JP1/SES events are filtered out.
Note that if you enable the severity changing function, Original Severity Level is displayed instead of Severity. When this function is enabled, the previous severity level is automatically input when you click the Read From Selected Event button or the Exclude by Common Exclusion-Conditions menu command.
For details on the severity changing function, see 4.11 Setting the severity changing function in the Job Management Partner 1/Integrated Management - Manager Configuration Guide.
-
- Character string editing (with input candidates)
-
This pattern applies when you select the following attributes:
-
Object type
-
Root object type
You can specify character strings containing a maximum of 64 bytes (Shit-JIS encoding). Alphabetic characters are case sensitive.
You can specify a maximum of 100 character strings by using a comma (,) as a separator. However, only one character string can be specified if Regular expression is selected.
To specify a comma (,) or backslash (\) as an ordinary character, prefix it with a backslash (\). That is, to use a comma (,), enter \,. To use a backslash (\), enter \\.
From the drop-down list on the right, select a condition for the specified character string from First characters, Match, Does not match, Is contained, Is not contained, and Regular expression.
-
- Event ID editing
-
This pattern applies when the following attribute is selected:
-
Event ID
You can specify a maximum of eight hexadecimal digits as an event ID. When specifying multiple event IDs, the entire string must not exceed 64 kilobytes. You cannot specify control characters. The range of specifiable values for hexadecimal numbers is 0 to 7FFFFFFF.
You can specify a maximum of 100 event IDs by using a comma (,) as a separator.
From the drop-down list on the right, select Match or Does not match as a condition for the specified event IDs.
-
- Date and time editing (range specification)
-
This pattern applies when you select the following attributes:
-
Start timeframe
-
End timeframe
The way in which you specify the date and time depends on the selected radio button.
-
If Specify date and time range is selected:
Specify the year, month, day, hour, minute, and second that serves as the base time of the range. Use the Specify date and time range option when specifying the range as an accumulated number of seconds.
You can enter the current time by clicking the Current Time button.
The way in which the period is specified depends on the selected radio button.
If the Period radio button is selected:
Specify the target range for the event condition as a period. From the drop-down list on the right, you can select XX days after, XX hours after, XX minutes after, XX days before, XX hours before, or XX minutes before.
If the Time radio button is selected:
Specify the end of the target range for the event condition as a date and time.
-
If Specify character string is selected:
Specify a character string of no more than 64 kilobytes (when Shift-JIS encoded). Use the Specify character string option when specifying the range as a character string. Alphabetic characters are case sensitive.
You can specify a maximum of 100 character strings by using a comma (,) as a separator. However, only one character string can be specified if Regular expression is selected.
To specify a comma (,) or backslash (\) as an ordinary character, prefix it with a backslash (\). That is, to use a comma (,), enter \,. To use a backslash (\), enter \\.
From the drop-down list on the right, select a condition for the specified character string from First characters, Match, Does not match, Is contained, Is not contained, and Regular expression.
-
- Date and time editing
-
This pattern applies when you select the following attributes:
-
Registered timeframe
-
Arrived timeframe
Specify the year, month, day, hour, minutes, and seconds.
You can enter the current time by clicking the Current Time button.
The way in which the period is specified depends on the selected radio button.
-
If the Period radio button is selected:
Specify the target range for the event condition as a period. From the drop-down list on the right, you can select XX days after, XX hours after, XX minutes after, XX days before, XX hours before, or XX minutes before.
-
If the Time radio button is selected:
Specify the end of the target range for the event condition as a date and time.
-
- Extended-attribute editing
-
This pattern applies when the following attribute is selected:
-
Extended attribute
In the Attribute name text box, you can enter a character string of no more than 32 bytes. The character string can contain upper-case alphabetic characters, numerals, and underscores (_). The first character must be an upper case alphabetic character. If you enter a lower-case character, it is converted to an upper-case character. You cannot specify common information as an extended attribute.
In the Condition text box, you can enter a character string of no more than 64 kilobytes (when Shift-JIS encoded). Alphabetic characters are case sensitive.
You can specify a maximum of 100 character strings by using a comma (,) as a separator. However, only one character string can be specified if Regular expression is selected.
To specify a comma (,) or backslash (\) as an ordinary character, prefix it with a backslash (\). That is, to use a comma (,), enter \,. To use a backslash (\), enter \\. Note that \, and \\ each count as one byte.
From the drop-down list on the right, select a condition for the specified character string from First characters, Match, Does not match, Is contained, Is not contained, and Regular expression.
-
- Numeric value editing
-
This pattern applies when you select the following attributes:
-
Registered reason
-
Source process ID
-
Source user ID
-
Source group ID
Specify a decimal integer of no more than 64 kilobytes. You can specify a value in the range from -2,147,483,648 to 2,147,483,647.
From the drop-down list on the right, select Match or Does not match as a condition for the specified numeric value.
When Match or Does not match is selected as the condition, you can only specify integers from 0 to 9 and hyphens (-).
You can specify a maximum of 100 numeric values by using a comma (,) as a separator.
-
- Apply
-
Click this button to apply the settings.