Extreme Networks ExtremeWare XOS Guide Manual page 105

Filtering By Components and Conditions. You may want to send the messages that come from a
specific component that makes up ExtremeWare XOS, or send the message generated by a specific
condition. For example, you might want to send only the messages that come from the STP component,
or send the message that occurs when the IP.Forwarding.SlowPathDrop condition occurs. Or you may
want to exclude messages from a particular component or event. To do this, you will construct a filter
that passes only the items of interest, and associate that filter with a target.
The first step is to create the filter using the
from scratch, or copy another filter to use as a starting point. It may be easiest to copy an existing filter
and modify it. To create a filter, use the following command:
create log filter <name> {copy <filter name>}
If you create a filter from scratch, it will initially block all events until you add events (either the events
from a component or a specific event condition) to pass. You might create a filter from scratch if you
wanted to pass a small set of events, and block most. If you want to exclude a small set of events, there
is a default filter that passes events at or above the default severity threshold (unless the filter has been
modified), named DefaultFilter, that you can copy to use as a starting point for your filter.
After you have created your filter, you can then configure filter items that include or exclude events
from the filter. Included events are passed, excluded events are blocked. To configure your filter, use the
following command:
configure log filter <name> [add | delete] {exclude} events [<event-condition> | [all
| <event-component>] {severity <severity> {only}}]
For example, if you create the filter myFilter from scratch, then issue the following command:
configure log filter myFilter add events stp
All STP component events will pass myFilter of at least the default threshold severity (for the STP
component, the default severity threshold is
additional conditions. For example, assume that myFilter is configured as before, and assume that you
want to exclude the STP.CreatPortMsgFail event. To add that condition, use the following command:
configure log filter myFilter add exclude events stp.creatportmsgfail
You can also add events and subcomponents to the filter. For example, assume that myFilter is
configured as before, and you want to include the STP.InBPDU subcomponent. To add that condition,
use the following command:
configure log filter myFilter add events stp.inbpdu
You can continue to modify this filter by adding more filter items. The filters process events by
comparing the event with the most recently configured filter item first. If the event matches this filter
item, the incident is either included or excluded, depending on whether the
used. Subsequent filter items on the list are compared if necessary. If the list of filter items has been
exhausted with no match, the event is excluded, and is blocked by the filter.
To examine the configuration of a filter, use the following command:
show log configuration filter {<filter name>}
The output produced by the command (for the earlier filter) is similar to the following:
Log Filter Name: myFilter
I/
E Comp.
ExtremeWare XOS 10.1 Concepts Guide
Sub-comp. Condition
command. You can create a filter
create log filter
). You can further modify this filter by specifying
error
Severity
CEWNISVD
Event Management System/Logging
keyword was
exclude
105