1. You need an edition of MonitorWare Agent / WinSyslog / EventReporter for this scenario.
Please Note: We are using MonitorWare Agent in this guide whereas MonitorWare Agent is superset of WinSyslog and EventReporter. So this guide is also applicable for WinSyslog and EventReporter.
2. In order to update a filter it’s necessary that you have a previously saved configuration in which you had applied filters. Click here if you wish to learn “How to add filters for database MonitorWare Agent, WinSyslog and EventReporter?”
Important note about Filter Condition
String comparison in Filter Conditions are “Case Sensitive”! For example, if the Source System name is “ws01” and you had written “WS01” while applying the filter, then this filter condition would “NEVER” evaluate to True! Please double check before proceeding further!
How to Delete Filters?
1. Lets say that initially we were interested in getting an e-mail alert in a given time period for the following filter condition:
( (Event ID is 500 OR 1000 OR 2000 OR 3000) ) AND ( FromHost is not equal to WS01 ) )
AND
( ( Event Source is equal to Security ) OR ( Priority is greater than 5 ) )
And the filter form looked like this:
2. Lets assume that you wish to delete some filter so the filter condition looks like:
( ( Event ID is not one of (500,1000,2000,3000) ) AND ( FromHost is not equal to WS01 ) )
You would have to follow the following steps in order to accomplish this.
3. There are two ways to accomplish this scenario. You can either delete the filters one-by-one or you can delete the whole “OR” operator. In this sample we guide you how to do these.
Deleting Filters One by One
4. This approach is recommended when you want to retain some part of the filter condition and to delete some part of the fiter in a more complex filter condition. Right Click on the filter property “Syslog Priority”, a pop up menu appears. Select delete from the menu.
When you have deleted the filter, your screen should look as follows:
5. Right Click on the filter property “Event Source”, a pop up menu appears. Select delete from the menu.
When you have deleted the filter, your screen should look as follows:
6. Right click on the lower OR. a pop up menu appears. Select delete from the menu.
When you have deleted the OR operation, your screen should look as follows:
Don’t forget to save the settings by clicking the (diskette-like) “Save” button.
Deleting Filters Completely in a Single Selection
7. This approach is recommended when you don’t need the entire part of the filter condition. Right click on the lower OR. a pop up menu appears. Select delete from the menu.
This process deletes the whole lower “OR” along with the filter conditions. When you have deleted the OR operation, your screen should look as follows:
Don’t forget to save the settings by clicking the (diskette-like) “Save” button.
8. Last, save the changes if you haven’t done it before and then restart the MonitorWare / WinSyslog or EventReporter service.
MonitorWare / WinSyslog or EventReporter cannot dynamically read changed configurations. As such,it needs to be restarted after such changes.