EMS Manual

Filter Tables and Burst Filters
EMS Manual—426909-005
6-7
Logical Connection Is AND

Use the object-based SPI command ADD to load multiple filters or a single filter
into a collector or distributor.
Filter names are submitted as multiple object token values. To remove a filter or
replace a set of filters with a PASSALL default filter, use the DELETE command. The
CONTROL command cannot be used by collectors to add, alter, replace, or delete
filters. For distributors, the CONTROL command cannot be used to load multiple filters
because it does not provide object tokens to specify filter files; in fact, it deletes all
other existing filter files when used to load a single new filter, so it should not be used
when more than one filter is required in a distributor. For a description of object-
oriented commands (ADD, ALTER, REPLACE, and so on) that you use to load filter
tables and other filter types, see the distributor and command information in
Section 17, Distributor Commands and Responses
and Section 19, Collector
Commands and Responses.
For more detailed guidelines on loading filters, see Section 7, Burst Detection and
Suppression.
Logical Connection Is AND
The logical connection between the single directives and between directives and actual
filter tables is AND. For each directive, only one value can be given. To implement OR
conditions for header tokens, more than one filter table can be connected in a cascade.
The logical connections between rows in the filter table are OR connections.
Restrictions
In a filter table, the maximum number of events per subsystem, when subtracting the
lowest event number from the highest, cannot exceed 4096. The maximum number of
subsystem IDs per owner, when subtracting the lowest from the highest, cannot
exceed 256.
Burst Filters
Use a burst filter—a type of filter table—to identify the criteria for event burst detection
and suppression (BDS) in a collector or distributor. When a burst filter is installed in a
collector or distributor, BDS prevents the forwarding of any event burst that exceeds
the specified number of events per time duration. In collectors, you can also enable
BDS using the SUPPRESS parameter of the EMSACOLL and EMSCCTRL programs.
However, a burst filter and the SUPPRESS parameter cannot be used simultaneously
to implement BDS for a given collector.
For a detailed description of the BDS feature of EMS, including methods for configuring
and implementing BDS in collectors and distributors, see Section 7, Burst Detection
and Suppression.
A burst filter, like any other filter, can be added, deleted, and used in conjunction with
compiled filters and standard filter tables. Like standard filter tables, you specify burst