You can configure to expire a filter by checking the "Filter Expires" check box on the Hour / Day tab. This enables you to create rules that will stop working at a particular day you set.
For example, you might be getting recurring email alerts for a particular problem that you are aware off. This problem is being addressed, but it will take three days to resolve it. As such, since you are aware of the problem you would probably prefer not to get alerts until the problem is supposed to be resolved.
If you simply create an exclude filter for the alert, then you could potentially forget about the problem. Instead, you can still create an exclude filter but this time set the exclude filter to expire at a particular day. In the example above, you would set the filter to expire right after the problem is supposed to be resolved. This way, you will continue to receive email alerts if the issue has not been resolved in time.
|
The EventSentry agent will log event id 250 with the warning severity (only on the host where EventSentry was installed with the setup) when a filter expires. This alert is only logged once unless the expiration date changes and a new configuration is applied. |
