EMS Manual

Compiled Filters
EMS Manual—426909-005
5-6
Considerations for Writing Filters
Efficiency
Filters help a forwarding distributor make the network more efficient. Unneeded event
messages that you exclude with a well-written filter help reduce network message
traffic.
Filters can help operator efficiency in the case of printing distributors. Extra messages
can delay the printing of important messages, and irrelevant messages can clutter a
listing, obscuring relevant messages.
Filters can reduce the amount of interprocess communication in the case of consumer
distributors.
To help decide whether to perform an operation in the filter or to perform it in an
application, consider:

The filter processes every message that the distributor reads. The application
processes only the selected messages.

Each time a filter examines a new event message, its Boolean variables are set to
FALSE. Therefore, if part of your selection logic requires saving the value of
comparisons across event messages, place that logic in the application, not in the
filter.

If the filter has categorized event messages while selecting them, the integer on
the PASS statement can be used to return the category to an application.
Some compiled filters are written with substantial TACL computations included in
brackets in the filter source. This strategy might appear inefficient but is not because
TACL expands these bracketed constructs during filter compilation, not during filter
execution.
Compatibility
Consider these points, which should help your filter perform without changes across
different versions of the SPI interface:

When the same information exists in an event message in two forms—a text form
for display purposes and an encoded form—comparisons in the filter should use
the encoded form. When information is duplicated in this way, HP reserves the
right to change the display text at any time.

Use volume names as opposed to logical device numbers where possible.
Caution. Do not use a forwarding distributor to return a message to its system of origin. Doing
so can cause a message loop that rapidly consumes system and network resources and
causes event-message flooding. Unexamined, relevant collector log files might be overwritten
if this continues with ROTATEFILES selected.