Editing A Rule; Ordering Rules - Novell SENTINEL LOG MANAGER 1.0.0.5 - ADMINISTRATION GUIDE 03-31-2010 Administration Manual

4 Specify a name for the rule.
5 Specify a filter value. The filter value can be the same value required to perform a search.
Click the show tips link to use the tag names defined in the table for defining rule filter. For
example, to define a rule that applies to all events with a severity of 3 or 5 use sev:[3 TO 5].
6 Select an action to be performed on every event that meets the filter criteria. The list of
available actions in the drop-down list is determined by the defined actions. Actions are created
and configured individually.
For more information about how to add, modify, and delete actions, see
on page
For each selected action, information is displayed to indicate where this action will send events.
The information comes from the configuration details for the action.
7 Click
8 Click
9 Click Save to save the rule.
The newly created rule appears under the Rules tab.

7.1.3 Editing a Rule

1 Log in to the Sentinel Log Manager as an administrator.
2 Click rules in the upper left corner of the page.
3 The Rules tab is displayed on the right pane of the page.
The created rules appear on the page.
4 Click the edit link next to the rule to change a rule definition.
5 Click Save to save the settings.
If the rules settings are changed, a

7.1.4 Ordering Rules

When there is more than one rule, the rules can be reordered by using drag-and-drop. Events are
evaluated by rules in the specified order until a match is made, so you should order rules
accordingly. More narrowly defined rules and more important rules should be placed at the
beginning of the list.
1 Log in to the Sentinel Log Manager as an administrator.
112 Sentinel Log Manager 1.0.0.4 Administration Guide
114.
icon to select additional actions to be performed.
to remove the selected action for this rule.
Successfully Saved Rule
"Configuring Actions"
message is displayed.