EMS Manual

Filter Tables and Burst Filters
EMS Manual—426909-005
6-2
Filter Table Format
The filter table contains three base columns: subsystem owner, subsystem ID, and
event number. You can replace the event number column with a standard type or user
type column. A hierarchical dependency exists between columns: an owner can have
several subsystem IDs, and a subsystem ID can have several event numbers.
You can specify a pass value for each event or group of events. The pass value is
returned to the application the same way that consumer distributors and compiled
filters currently provide.
Filter table directives allow filtering by other event header tokens (process name, node,
CPU, PIN, emphasis, user ID, time).
Filter tables can be added, deleted, or replaced with standard SPI commands sent to a
collector or distributor.
Filter tables can co-exist with compiled filters in collectors or distributors. The total
number of filters allowed in a collector or distributor is 10.
Filter Table Format
A filter table is represented as an EDIT file. When loaded into a collector or distributor,
the table is automatically converted to a filter object and saved as a disk file. After the
object file is available, it can be loaded into a collector or distributor instead of the EDIT
file.
The name of the object file is derived from the source file by prefixing an “O” character
(as in “Object”). If the file name is already eight characters long, the last character is
discarded.
For example, the format of the EDIT file is:
?COMMENT
EMS FILTER TABLE
?EMPHASIS 1
?USER 165,168
?COMMENT
owner subsys event# passval
?PASS
TANDEM EMS 1000..1050 10
1100
TMF * 20
TLAM -3 30
513 31
139 32
MYSYS 15 100..500 40
YOURSYS * 50
The filter table EDIT file is divided into sections. Any blank lines or lines with an
exclamation mark in the first column are skipped. Lines with a question mark (?) in the