Critical System Protection

 View Only
  • 1.  Event Suppression

    Posted Jan 27, 2014 04:48 PM

    I am trying to suppress a certain event from logging to the DB and console. I ran the event wizard and found out that this cannot be performed automatically by the wizard. I followed the Action Details that stated to edit the Prevention Parameter configuration. I created a Prevention Parameter, selected the Log Rules Tab, Add Rule, but there is no radio button "Ignore the event". I'm not sure where or how to filter off events. The instructions are not clear to me. There is nothing in the admin guide that talks about it that I can see. We are using 5.2.9 MP1 on Windows 2008R2.



  • 2.  RE: Event Suppression

    Posted Jan 28, 2014 08:36 AM

    What sort of event are you wanting to ignore?  The way i do it is by using a negative boolean logic:

     

    Add this rule to the top of your filter

    Transmit when event ID does NOT equal "event ID"

    itll then transmit all events exept that particular one.

     

    You can then add more if you wish with extra OR events.



  • 3.  RE: Event Suppression

    Posted Jan 29, 2014 10:24 AM

    Alex is correct.  The default behavior is to NOT send, so if there is not a rule match, the event will not be sent.



  • 4.  RE: Event Suppression
    Best Answer

    Posted Feb 04, 2014 03:21 PM

    Ok, thanks for the heads up, at least I got to the right area to control this. Its just a matter of getting used to the filter rules.