Navigation:  Monitoring with EventSentry > Event Log Monitoring > Filters >

Filter Processing

 Top  Previous  Next

In order to setup advanced configurations with EventSentry it is sometimes necessary to understand how filters are processed. Please take the following rules into consideration when setting up many filters in multiple packages:

 

1.Only filters from global or assigned packages will be processed.
 
2.A notification is never processed more than once. That is, if two filters using the same notification match an event, that event will still only be forwarded once to the notification.
 
3.Exclude filters from all packages are always checked before an event is forwarded to a notification. Exception: An event log package is configured to ignore foreign excludes - in this case only exclude filters from the same package as the include filter are checked.
 
4.Filters from Catch-All packages are always processed after filters from Non-Catch-All packages.
 
5.If an include filter with a threshold setting matches an event then any subsequently matching filter will not process the event.
 
6.Packages are processed in the order show in the management application, with the exception of Catch-All packages which are always processed after Non-Catch-All packages.

 

Flowchart

Please see the flowchart below to see how filters are processed:

 

Filter Processing Flow Chart