EMS Manual

Filter Tables and Burst Filters
EMS Manual—426909-005
6-4
Filter Table Keywords
Considerations for Keywords
All values are tested for equality with their counterparts in the event header.
Generation time is first converted to local civil time.
Other keywords that are processed as filter table directives are ?PASS, ?FAIL, and
?COMMENT. One ?PASS or ?FAIL directive is required. A ?COMMENT directive is
terminated when another directive is encountered.
Directives are not allowed in the actual filter table body. You can place comments by
using the exclamation mark (!) in the first column or anywhere in column 50 and
beyond.
?EMPHASIS n
n is either (0) or (1) and signifies the severity of the event. If set to (1),
the event is considered critical.
?USER n,m
n is the group number and m the user number of the user ID
associated with the process that generated the event. Either one must
be smaller than 256. The user number can be the asterisk (*) wild-card
character (example: 255,*).
?START time
time is the start time given in hh:mm (hours:minutes, local civil time).
If stop time is not given, the following midnight 0:00 is used. Any event
that has a generation time outside the start/stop interval fails a PASS
filter. The date portion of the timestamp is not considered; that is, the
filter operates on a daily basis and need not be updated. Not available
with compiled filters.
?STOP time
time is the stop time given in hh:mm (hours:minutes, local civil time).
Stop time must be larger than start time. If start time is not given, the
previous midnight 00:00 is used. Any event that has a generation time
outside the start/stop interval fails a PASS filter. The date portion of the
timestamp is not considered; that is, the filter operates on a daily basis
and need not be updated. Not available with compiled filters.
?STYPE [n]
n is an enumeration for the standard event type. The possible range
for n is defined in the event standards section of the ZEMSDDL file.
Zero is not a valid type. If n is omitted, it is assumed that the event
number column in the filter table is to be interpreted as standard event
type column.
?UTYPE [n]
n is an enumeration for the user-defined event type. Some possible
values for n are defined in the event standards section of the
ZEMSDDL file. Zero is not a valid type. ?STYPE and ?UTYPE are
mutually exclusive. If n is omitted, it is assumed that the event number
column in the filter table is to be interpreted as user-defined event type
column.
Table 6-1. Filter Table Keywords (page 2 of 2) (continued)
Keyword Description