Regular Expressions In Filters; Event Filter Examples; Event Buffer Filtering - IBM Enterprise Console Manual

Regular Expressions in Filters: You can also use Tcl regular expressions in
filtering statements. The format of a regular expression is
Note: Tivoli Event Integration Facility uses an exception to the Tcl regular
expression syntax. The backslash character ( ) in Tivoli Event Integration
Facility indicates that the following literal character is the character to filter
for, not some special character such as a tab. For example,
character in Tcl, but means
The following example shows a Filter statement with a regular expression. This
filter statement matches all events with a class name that contains
in its name:
The following example shows a FilterCache statement with a narrower range. This
filter statement matches all events with a class name that contains
in its name and has a severity of critical:
For more information about Tcl regular expressions, see a Tcl user's guide.
Event Filter Examples: The following table shows some event filter examples for
a few different adapters:
Adapter Example
AS/400 Alert The following entry matches all events of the
SNA_Equipment_Malfunction class from the origin 1.2.3.4:
UNIX Log File The following entry matches all events of the Su_Success class from
the origin 126.32.2.14:
OpenView The following entry matches all events of the OV_Message class from
the origin 126.32.2.14:
Windows NT The following entry matches all events of the NT_Power_Failure
class from the origin 126.32.2.14:

Event Buffer Filtering

When an adapter is unable to connect to the event server or IBM Tivoli Enterprise
Console gateway, it sends the events to a file if the BufferEvents keyword is set to
. You can filter events sent to a cache file, similar to filtering events for the
event server by using the FilterCache keyword.
There are no default event cache filters in the configuration files shipped with
adapters.
The following procedures describe how to filter events with the FilterCache and
FilterMode keywords, when the event server is unavailable:
v To cache specific events:
1. Set FilterMode to IN.
2. Set BufferEvents to YES (the default value).
in Tivoli Event Integration Facility.
Chapter 1. Understanding Adapters
value_fragment .
means the tab
somewhere
somewhere
15