How to create complex filter conditions?
Created 2003-05-13 by Usman Khawaja.
I would like to create some more complex filters by combining ANDs and ORs.
(condition “a” AND condition “b”)
OR
(condition “c” AND condition “d”)
OR
…
where “condition a” could be one of the choices like “syslog priority < 4 “, etc.
In order to create the above mentioned scenario, follow these steps:
- First create a rule set and add rule to it. Click on the filter conditions of that rule set. You will see the default form for filter conditions. By default there is an AND condition set in the filter condition form. You can change that operator to OR/XOR/NOT/TRUE/FALSE by double clicking on the AND operator.
- Now Click on the AND operator from the toolbar shown on right side of the filter conditions form (in MonitorWare agent) in order to AND the conditions a and b. right click on the AND operator (which you just added) and add filter conditions.
- Now again click on the OR operator at the top and insert another AND operator from the tool bar. Follow the same process which you did in step 2, i.e. right click on the AND operator and add filter conditions c and d. You can create as many AND conditions as you like in order to implement the OR operator among them.
Please have a look at the picture below. It would give you better understanding of creating filter conditions for nested conditions.
Please note that this information is only applicable to WinSyslog 5.x and above, EventReporter 6.x and above and MonitorWare Agent 1.x and above.