EMS Manual

Compiled Filters
EMS Manual—426909-005
5-8
Overview of Filter Operation
information about filter tables and burst filters, see Section 6, Filter Tables and Burst
Filters.
Overview of Filter Operation
A filter operates in a collector or a distributor, which might already be running or must
be started. You configure filters in an alternate collector or distributor when they are
first started by specifying the filters in the startup options. Use the EMSACOLL
program to start an alternate collector. For details, see “EMSACOLL—Alternate
Collector Program on page 13-2. Use the EMSDIST program to start a distributor. For
details, see EMSDIST—Distributor Program
on page 13-34.
Alternatively, filters can be configured in a primary or alternate collector or a distributor
dynamically (that is, while they are running) by using object-oriented SPI commands to
ADD, ALTER, REPLACE, or DELETE filters.
Filter parameters are analogous to procedure parameters. They let you delay the
specification of certain token values until you install the filter or let you change the
values during operation. You can change these filter parameters only with the
object-oriented SPI ADD, ALTER, REPLACE, or DELETE commands.
The collector in which a filter operates reads event messages sequentially as they are
received through WRITE or WRITEREAD procedures from a subsystem. The
distributor in which a filter operates reads event messages sequentially from a series of
one or more log files. Each time the collector or distributor reads an event message, it
executes the filter.
Each token name refers to a parameter token if the name matches the name of a
declared parameter token. Otherwise, the name refers to a token in the current event
message—that is, the event message that the distributor read last.
Filter execution terminates if a PASS statement is executed, if a FAIL statement is
executed, or if control reaches the last statement of the filter without executing a PASS
or FAIL, which is an implicit FAIL. Consequently, each event message either passes or
fails the filter.
The collector or distributor uses the event message—sends it to a log file, prints it,
forwards it, or sends it to an application—if the message passes the filter. Otherwise,
the collector or distributor ignores the event message.
Pass or fail, the collector or distributor is then ready to read another event message
and to begin the cycle again.
TACL Environment
The filter language uses TACL as a preprocessor. TACL expands source text within
brackets before the compiler processes it. You must treat characters that are special to
TACL in a special way.
Note. Symbolic names in this section are in TACL form, using circumflex (^) symbols rather
than hyphens, because of the interface of the filter language to TACL.