XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 3. Configuring Filters and the FILTERS File
XYPRO Technology Corporation 44 Proprietary and Confidential
3.3 Building a Filter
Note: The easiest way to build a new Filter is to start with a copy of an existing Filter.
This will ensure that the syntax is correct and let you concentrate on getting the
selection criteria right.
There are eight basic steps required to build a Filter:
Step 1. Name the Filter.
Step 2. Set the Filter Status.
Step 3: Set the EVALUATE_MSG Keyword.
Step 4. Define the Filter’s Mover that will capture the chosen event.
Step 5. Define the Filter’s Data Selection Criteria that makes the audit event you are
interested in unique.
Step 6. Define the Filter’s Action you want to occur when the event occurs.
Step 7. Syntax Check and Compile Your FILTERS File.
Step 8. Test Your Alerts to be sure the communications parameters are correct.
3.3.1 Step 1. Name the Filter
Each Filter Definition requires a name. The format of the name is as follows:
• Must start with a dollar sign ($).
• Can be up to 32-alphanumeric characters in length.
• The dash ( - ), underscore ( _ ), and period ( . ) characters are also permitted.
Examples:
FILTERDEFBEGIN $SCF_255_ALERTS
$IGNORE-UNWANTED-SFG-CODES
$SfgConfigChgs.EMS.Alert
3.3.2 Step 2. Set the Filter Status
Each Filter Definition has a status. The STATUS activates or deactivates the Filter.
When a Filter is INACTIVE, the MOVERs will ignore it; that is, they will not compare
their audit events against it.
Syntax:
STATUS {ACTIVE|INACTIVE}
Note: All Filters are checked for syntax errors, regardless of their STATUS.