3.16.1 Common exclusion-conditions page

The Common exclusion-conditions page is used to set common exclusion-conditions in extended mode.

Note that if no common exclusion-conditions are set in extended mode on this page (that is, no event conditions are displayed in the Event conditions list), all JP1 events will be filtered out. To perform filtering, make sure that at least one condition is set.

Figure 3‒33: Common exclusion-conditions page

The following describes the items displayed on the Common exclusion-conditions page.

Event conditions list

A list of common exclusion-conditions in extended mode is displayed. Conditions that are higher in the list have higher priority.

The Attribute name column displays the attribute name of each event condition. If an extended attribute is specified for a condition, E is prefixed to the character string that the user specified as an attribute name. For example, if TEST is specified as the name of an extended attribute, E.TEST is displayed.

The Attribute value column displays the value or values of each attribute. If there are multiple values, each value is separated by a comma (,).

The Condition column displays one of the following event condition comparison methods: First characters, Match, Does not match, Is contained, Is not contained, Regular expression, Period, and Time.

Read From Selected Event

Click this button to reflect the attribute values of the JP1 event selected in the Event Console window into the Event conditions list. The following table describes how attribute values are reflected into the list. The byte counts in the table are for Shift-JIS-encoded character strings.

Table 3‒12: Behavior when the Read From Selected Event button is clicked
Event attribute values		Behavior
Length	Control character^#1	Behavior
4,096 or fewer bytes	Not included	All event attribute values are reflected into the list. For an attribute for which an optional condition can be specified, Match is selected.
4,096 or fewer bytes	Included	The character string before the first control character is reflected into the list. For an attribute for which an optional condition can be specified, First characters is selected.
4,097 or more bytes	Not included	The first 4,096 bytes^#2 are reflected into the list. For an attribute for which an optional condition can be specified, First characters is selected.
	Included in the first 4,096 bytes	The character string before the first control character is reflected into the list. For an attribute for which an optional condition can be specified, First characters is selected.
	Included in the 4,097th and following bytes	The first 4,096 bytes^#2 are reflected into the list. For an attribute for which an optional condition can be specified, First characters is selected.

#1:: Whether the event attribute values include control characters such as line breaks and tabs.
#2:: If the boundary between the 4,096th and 4,097th bytes splits a multi-byte character, the character is not reflected into the list.

Note that display items of the selected JP1 event might be mapped to extended attributes in the Event-Information Mapping Definitions window. In this case, neither the values of the display items nor the values of the mapped extended attributes are reflected into the Event conditions list. For details about event-information mapping definitions, see 6.9.2 Displaying extended attributes of JP1 events (mapping of event information) in the JP1/Integrated Management 2 - Manager Administration Guide.

Add

Click this button to add the event condition selected in the lower list to the Event conditions list. Added event conditions are displayed at the bottom of the Event conditions list. The event conditions that have already been in the Event conditions list are not added. A maximum of 256 event conditions can be added.

Delete

Click this button to delete the selected event condition.

Up

Click this button to move the event condition selected in the Event conditions list up by one line. Use this button to change the priority of the event conditions.

Down

Click this button to move the event condition selected in the Event conditions down by one line. Use this button to change the priority of the event conditions.

Area for editing event conditions

This area is used to edit event conditions in common exclusion-conditions in extended mode. The pattern of this area changes according to the selected attribute. The patterns that can be displayed are described below.

Note that if the Common Exclusion-Condition Settings (Extended) window is opened by choosing Exclude by Common Exclusion-Conditions, the attribute names and values for the JP1 event selected in the source window are automatically set as conditions. The attribute names and values that are set automatically can be set by using the common-exclusion-conditions auto-input definition file. The behavior of the system when an attribute value is longer than 4,096 bytes (when Shift-JIS encoded) or includes control characters is the same as when the Read From Selected Event button is clicked. For details about this file, see Common-exclusion-conditions auto-input definition file (common_exclude_filter_auto_list.conf) in 2. Definition Files in the manual JP1/Integrated Management 2 - Manager Command, Definition File and API Reference. In the drop-down list on the right, Match is selected as the comparison method for the specified character string if the total length of the attribute values does not exceed 4,096 bytes. If 4,096 bytes (when Shift-JIS encoded) is exceeded or the attribute value contains a control character, First characters is selected.

Character string editing

[Figure]

This pattern applies when one of the following attributes is selected:

Event source host name
Source host
Object name
Root object name
Occurrence
User name
Message
Product name
Source user name
Source group name
Source IP address
Object ID
Return code

When specifying an IPv6 address for Source IP address, alphabetic characters must be lower case, as shown below:

0011:2233:4455:6677:8899:aabb:ccdd:eeff

You cannot specify an IP address in abbreviated form like the one shown below:

2012:7:8::a:b

If the integrated monitoring database and IM Configuration Management database are enabled, you can specify a business group name in path format for Source host and Event source host name. Either Match or Does not match can be selected as a condition. If these databases are disabled and the selected condition is not Match or Does not match, a business group name specified in path format is treated as a host name.

Note that Event source host name can be specified only if event source host mapping is enabled. If this mapping is disabled, conditions for Event source host name can be specified by specifying JP1_SOURCEHOST as the attribute name when the area for editing event conditions is in the Extended-attribute editing pattern.

A character string of 64 kilobytes or less (when Shift-JIS encoded) can be specified. Alphabetic characters are case sensitive.

You can specify a maximum of 100 character strings by using a comma (,) as a separator. However, only one character string can be specified if Regular expression is selected.

To specify a comma (,) or backslash (\) as an ordinary character, prefix it with a backslash (\). That is, to use a comma (,), enter \,. To use a backslash (\), enter \\.

From the drop-down list on the right, select a condition for the specified character string from First characters, Match, Does not match, Is contained, Is not contained, and Regular expression.

If Regular expression is not selected in the drop-down list on the right when ON is set for the -ignorecasehost option of the jcoimdef command, the case of alphabetic characters is ignored for the following attributes:

Source host
Event source host name

Severity-level editing

[Figure]

This pattern applies when the following attribute is selected:

Event level

Which events are filtered out depends on the selected radio button.
If All events for which severity has been defined is selected:

All events for which severity (an event level) is defined are filtered out.
If Specify the severity is selected:

Events assigned a specific severity are filtered out.

You can select Emergency, Alert, Critical, Error, Warning, Notice, Information, or Debug as the severity.
If JP1/SES events is selected:

JP1/SES events are filtered out.

Note that if you enable the severity changing function, Original Severity Level is displayed instead of Severity. When this function is enabled, the previous severity level is automatically input when you click the Read From Selected Event button or the Exclude by Common Exclusion-Conditions menu command.

For details on the severity changing function, see 5.13 Setting the severity changing function in the JP1/Integrated Management 2 - Manager Configuration Guide.

Character string editing (with input candidates)

[Figure]

This pattern applies when you select the following attributes:

Object type
Root object type

Specify a character string of no more than 64 kilobytes (when Shift-JIS encoded). Alphabetic characters are case sensitive.

You can specify a maximum of 100 character strings by using a comma (,) as a separator. However, only one character string can be specified if Regular expression is selected.

To specify a comma (,) or backslash (\) as an ordinary character, prefix it with a backslash (\). That is, to use a comma (,), enter \,. To use a backslash (\), enter \\.

Event ID editing

[Figure]

This pattern applies when the following attribute is selected:

Event ID

You can specify a maximum of eight hexadecimal digits as an event ID. When specifying multiple event IDs, the entire string must not exceed 64 kilobytes. You cannot specify control characters. The range of specifiable values is from 0 to 7FFFFFFF.

You can specify a maximum of 100 event IDs by using a comma (,) as a separator.

From the drop-down list on the right, select Match or Does not match as a condition for the specified event IDs.

Date and time editing (range specification)

[Figure]

This pattern applies when you select the following attributes:

Start timeframe
End timeframe

The way in which you specify the date and time depends on the selected radio button.

If Specify date and time range is selected:

Specify the year, month, day, hour, minute, and second that serves as the base time of the range. Use the Specify date and time range option when specifying the range as an accumulated number of seconds.

You can enter the current time by clicking the Current Time button.

The way in which the period is specified depends on the selected radio button.

• If the Period radio button is selected:

Specify the target range for the event condition as a period. From the drop-down list on the right, you can select XX days after, XX hours after, XX minutes after, XX days before, XX hours before, or XX minutes before.

• If the Time radio button is selected:

Specify the end of the target range for the event condition as a date and time.
If Specify character string is selected:

Specify a character string of no more than 64 kilobytes (when Shift-JIS encoded). Use the Specify character string option when specifying the range as a character string. Alphabetic characters are case sensitive.

You can specify a maximum of 100 character strings by using a comma (,) as a separator. However, only one character string can be specified if Regular expression is selected.

To specify a comma (,) or backslash (\) as an ordinary character, prefix it with a backslash (\). That is, to use a comma (,), enter \,. To use a backslash (\), enter \\.

From the drop-down list on the right, select a condition for the specified character string from First characters, Match, Does not match, Is contained, Is not contained, and Regular expression.

Date and time editing

[Figure]

This pattern applies when you select the following attributes:

Registered timeframe
Arrived timeframe

Specify the year, month, day, hour, minutes, and seconds.

You can enter the current time by clicking the Current Time button.

The way in which the period is specified depends on the selected radio button.

If the Period radio button is selected:

Specify the target range for the event condition as a period. From the drop-down list on the right, you can select XX days after, XX hours after, XX minutes after, XX days before, XX hours before, or XX minutes before.
If the Time radio button is selected:

Specify the end of the target range for the event condition as a date and time.

Extended-attribute editing

[Figure]

This pattern applies when the following attribute is selected:

Extended attribute

Specify a condition for the program-specific extended attribute.

Depending on the selected radio button, the item that can be specified differs.

When Attribute name is selected:

Specify a condition for the program-specific extended attribute by using an attribute name.

In the Attribute name text box, you can enter a character string of no more than 32 bytes. The character string can contain upper-case alphabetic characters, numerals, and underscores (_). The first character must be an upper case alphabetic character. If you enter a lower-case character, it is converted to an upper-case character. You cannot specify common information as an extended attribute.
When Item name is selected:

Specify a condition for the program-specific extended attribute by using an item name.

Specify a condition by selecting an item name from the Item name drop-down list. The displayed item names are program-specific extended attributes specified for the standard file and the extended file of the definition file for extended event attributes.

In the Condition text box, specify a character string of no more than 64 kilobytes (when Shift-JIS encoded). Alphabetic characters are case sensitive.

You can specify a maximum of 100 character strings by using a comma (,) as a separator. However, only one character string can be specified if Regular expression is selected.

To specify a comma (,) or backslash (\) as an ordinary character, prefix it with a backslash (\). That is, to use a comma (,), enter \,. To use a backslash (\), enter \\. Note that \, and \\ each count as one byte.

Numeric value editing

[Figure]

This pattern applies when you select the following attributes:

Registered reason
Source process ID
Source user ID
Source group ID

Specify a decimal integer of no more than 64 kilobytes. You can specify a value in the range from -2,147,483,648 to 2,147,483,647.

From the drop-down list on the right, select Match or Does not match as a condition for the specified numeric value.

When Match or Does not match is selected as the condition, you can only specify integers from 0 to 9 and hyphens (-).

You can specify a maximum of 100 numeric values by using a comma (,) as a separator.

Apply

Click this button to apply the settings.

To Page Top