EMS Manual

EMS Manual—426909-005
6-1
6 Filter Tables and Burst Filters
This section describes filter tables and burst filters and describes how to construct,
add, replace, and delete them from a collector or distributor:
For more information on compiled filters, the EMS filter (EMF) language, and the filter
compiler, see Section 5, Compiled Filters. For more information on configuring and
implementing BDS in a collector or distributor, see Section 7, Burst Detection and
Suppression.
Both collectors and distributors support filter tables and burst filters, which you can use
instead of or in addition to compiled filters.
Filter Tables
You can use filter tables to minimize the complexity of EMS filter installation. Because
they are faster than compiled filters, they reduce event processing times. You can use
filter tables instead of—or, in the case of multiple filters, in conjunction with—standard
compiled filters.
Because a compile step is not required, filter tables offer ease of maintenance and
improved efficiency. They are particularly useful when you need to filter events by
simple criteria such as event number and subsystem ID, and when there you need
frequent and fast online update of filter contents.
Filter Table Features and Functions
A filter table contains columns and rows of subsystem owners, subsystem IDs (text or
numeric), and event numbers. You can define the table type as PASS or FAIL.
A PASS filter selects events to forward to their appropriate destinations. For collector-
based filter tables, these are disk log files; for distributor-based filter tables, they can
include such destination devices as printers, operator terminals, log files, or
management applications.
A FAIL filter, conversely, selects events to be discarded. If you specify only one PASS
filter table, events that are not selected by the filter table are not logged to disk or other
destination devices. If you specify only one FAIL filter table, events not selected by the
filter are forwarded to their destination device.
The filter table’s source is written to an EDIT file and can be loaded directly into an
EMS collector or distributor. The collector or distributor compiles the source file and
saves the filter object in a disk file. After an object file has been obtained, it can be
loaded into the collector or distributor instead of the source.
Topic Page
Filter Tables
6-1
Burst Filters 6-7