IBM Enterprise Console manual Event Buffer Filtering, Set FilterMode to IN

Regular Expressions in Filters: You can also use Tcl regular expressions in filtering statements. The format of a regular expression is re:’value_fragment’.

Note: Tivoli Event Integration Facility uses an exception to the Tcl regular expression syntax. The backslash character (\) in Tivoli Event Integration Facility indicates that the following literal character is the character to filter for, not some special character such as a tab. For example, \t means the tab character in Tcl, but means t in Tivoli Event Integration Facility.

The following example shows a Filter statement with a regular expression. This filter statement matches all events with a class name that contains TEC_ somewhere in its name:

Filter:Class=re:’TEC_.*’

The following example shows a FilterCache statement with a narrower range. This filter statement matches all events with a class name that contains TEC_ somewhere in its name and has a severity of critical:

FilterCache:Class=re:’TEC_.*’;severity=CRITICAL

For more information about Tcl regular expressions, see a Tcl user’s guide.

Event Filter Examples: The following table shows some event filter examples for a few different adapters:

Adapter	Example
AS/400 Alert	The following entry matches all events of the
	SNA_Equipment_Malfunction class from the origin 1.2.3.4:
	Filter:Class=SNA_Equipment_Malfunction;origin=1.2.3.4
UNIX Log File	The following entry matches all events of the Su_Success class from
	the origin 126.32.2.14:
	Filter:Class=Su_Success;origin=126.32.2.14
OpenView	The following entry matches all events of the OV_Message class from
	the origin 126.32.2.14:
	Filter:Class=OV_Message;origin=126.32.2.14
Windows NT	The following entry matches all events of the NT_Power_Failure
	class from the origin 126.32.2.14:
	Filter:Class=NT_Power_Failure;origin=126.32.2.14

Event Buffer Filtering

When an adapter is unable to connect to the event server or IBM Tivoli Enterprise Console gateway, it sends the events to a file if the BufferEvents keyword is set to YES. You can filter events sent to a cache file, similar to filtering events for the event server by using the FilterCache keyword.

There are no default event cache filters in the configuration files shipped with adapters.

The following procedures describe how to filter events with the FilterCache and FilterMode keywords, when the event server is unavailable:

vTo cache specific events:

1.Set FilterMode to IN.

2.Set BufferEvents to YES (the default value).

Chapter 1. Understanding Adapters 15